The Agent Harness Pattern: Why Bounded Delegation Beats One Big Autonomous Agent
The safest AI system is not the smartest one. It is the one that cannot do the wrong thing even when it is wrong.
There are two common ways to build with AI agents, and both are bad. The first lets the agent do almost nothing, so it is safe and useless. The second hands it broad credentials and a free-form shell, so it is powerful and dangerous. The agent harness is the third way: the agent can see everything relevant, propose exactly what it wants, and touch nothing until a check passes.
A harness is not a smarter agent. It is a smaller job, an independent reviewer, and a receipt for every action.
What a harness actually is
A harness is a coordinator that hands a worker model a bounded job packet: a specific task, a short list of allowed sources, hard limits, and a required output shape. The worker does only that. Its result is not accepted on faith — a second, independent pass tries to refute it. Only what survives is kept. The master model, which holds the wide context, decides what is finally used or published.
Why this beats a single autonomous agent
A large autonomous agent fails in ways that are hard to catch: it drifts off task, invents a citation, or takes a write action nobody reviewed. A harness makes those failures structural instead of hopeful. The worker cannot browse outside its allowlist. It cannot run a generic shell. It cannot deploy or delete without a separate approval. When its output does not match the schema, the coordinator rejects it and retries rather than passing malformed work downstream.
The pieces that make it trustworthy
Four parts do the work. A landing guide briefs every worker with its target, limits, and hard-no list before it starts. A verifier pass checks the first result independently. A continuity keeper holds a compact project memory so a cheap worker does not need the whole history. And a tamper-evident audit chain records each step so a person can reconstruct what happened. None of these require a bigger model — they require a better structure.
Where it runs
The pattern maps cleanly onto edge infrastructure. A durable coordinator object holds one job queue per user; small models do extraction and comparison; deterministic checks (is this page up, does this text match) run with no model at all. The result is a system that can run bounded work around the clock without ever holding a credential it could leak. AMH's Cloudflare Ops MCP agent harness is one working example of the pattern.
The takeaway
If you are nervous about letting an agent act, the answer is rarely a better prompt. It is a harness: narrow the job, verify the result, log the action, and keep the power to approve in a human's hands. Capability without blast radius is a design, not a wish.