--- title: "How an AI Agent Harness Works | Metacamp Journal" description: "An agent harness is the software around an AI model. See how its loop, tools, memory, permissions, evaluation and containment work, in plain language." url: https://www.metacamp.sg/journal/how-an-ai-agent-harness-works/ markdown: https://www.metacamp.sg/journal/how-an-ai-agent-harness-works.md note: "The Markdown version of the page at url. Generated from that page when the site is built; the two say the same thing." --- Agentic thinking · 14 min read Field note 015 Agentic thinking # How an AI agent harness works: the six parts around the model A plain-language look inside the software that turns an AI model into a working agent. An AI agent harness is the software around a language model that lets it carry out a task. It runs the loop, connects tools, manages memory and context, asks a person before risky steps, tests the work and limits the damage when something goes wrong. The model suggests the next step, and the harness decides whether it happens. 11 NOV 2026 · Metacamp Editorial · Facts checked 11 November 2026 All entries **The short answer:** an AI agent harness is the software around a language model that lets it carry out a task. It runs the model again and again until the task is done or a limit is hit, turns its requests into real actions such as searching files or sending email, decides what it sees and remembers, asks a person before risky steps, tests it on known cases before and after every change, and limits the damage when something goes wrong. The model suggests the next step, and the harness decides whether it happens. As Anthropic's engineers put it, when you evaluate an agent, "we're evaluating the harness and the model working together" ( [Anthropic, 2026](https://www.anthropic.com/engineering/demystifying-evals-for-ai-agents) ). [The AI agent harness explained](https://www.metacamp.sg/journal/ai-agent-harness-explained/) is our ten-minute, six-question map for judging any AI tool. This guide opens the harness up. ## 01 What is an agent harness? A language model on its own does one thing: text goes in and text comes out. It cannot open your files, send an email or remember yesterday's conversation. The harness is the software added around it to make a working agent, so every agent is a model plus a harness. It is ordinary software: rules, settings and code that people write and can inspect. Anthropic defines an agent harness, or scaffold, as "the system that enables a model to act as an agent" ( [Demystifying evals for AI agents](https://www.anthropic.com/engineering/demystifying-evals-for-ai-agents) ). Singapore's Model AI Governance Framework for Agentic AI, published by IMDA, lists the same building blocks: instructions, memory, planning, tools, protocols for connecting tools, controls ("access controls, guardrails, human approvals") and logging ( [IMDA, version 1.5](https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf) ). Fig. 01 One model, six harness parts around it. ## 02 1. The loop: how an agent keeps going A chatbot answers once and stops. An agent works in a loop: Anthropic describes agents as "typically just LLMs using tools based on environmental feedback in a loop" ( [Building effective agents](https://www.anthropic.com/engineering/building-effective-agents) ). The Claude Agent SDK documentation sets out the cycle: Claude "evaluates your prompt, calls tools to take action, receives the results, and repeats until the task is complete" ( [How the agent loop works](https://code.claude.com/docs/en/agent-sdk/agent-loop) ). OpenAI's Agents SDK documents the same cycle ( [Running agents](https://openai.github.io/openai-agents-python/running_agents/) ). 1. The harness puts together what the model will see: its instructions, the task, any relevant memory and everything so far. 2. The model replies with either a final answer or a request to use a tool. 3. The harness checks the request against its rules. If it is allowed, the harness runs it and records it. 4. The result goes back to the model, and the cycle starts again. There are two ways out. One is a final answer with no more tool requests. The other is a limit: the harness can cap the turns or the spend, and a person can stop the run. Anthropic recommends "stopping conditions (such as a maximum number of iterations)", and the SDK documentation notes that without limits the loop "runs until Claude finishes on its own". Fig. 02 The agent loop: four stations and two exits. A loop with no limit can repeat a mistake or keep spending money. Diagnosing agents that "loop, stall or produce confidently wrong output" is a full topic in [GAI201](https://www.metacamp.sg/courses/gai201/) . ## 03 2. Tools: how a model "does" things The model never presses a button itself. To search a folder, it writes a structured request with the tool's name and its inputs. The harness reads the request, decides whether it is allowed and, if so, runs it. IMDA's framework says tools let an agent "take actions and interact with other systems, such as writing to files and databases, controlling devices, or performing transactions". Standard connectors such as the Model Context Protocol (MCP), "an open-source standard for connecting AI applications to external systems", let one harness plug into many tools ( [MCP documentation](https://modelcontextprotocol.io/docs/getting-started/intro) ). The Agent SDK documentation puts the division of labour this way: "Claude determines which tools to call based on the task, but you control whether those calls are allowed to execute." Fig. 03 One tool call, message by message. Fewer, narrower tools mean less risk. The OWASP GenAI Security Project lists "excessive agency" among the top risks for AI applications and advises limiting the extensions an agent can call "to only the minimum necessary" ( [OWASP LLM06:2025](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/) ). A tool that only reads your calendar is safer than one with full access to your email. ## 04 3. Memory and context: what the agent sees and keeps The model keeps nothing between requests. On every turn the harness lays out everything the model can see: the context window. The Agent SDK documentation lists its contents as the system prompt, tool definitions, the conversation history, and tool inputs and outputs. "Everything accumulates." The window has a fixed size. As it nears its limit, the harness summarises older parts of the conversation, a step called compaction. The documentation warns that "specific instructions from early in the conversation may not be preserved", so rules that must always apply belong in a file loaded on every request. Long-term memory lives outside the model: notes files, a document library searched when needed (retrieval-augmented generation, or RAG), saved preferences and records of past sessions. Anthropic notes that "each new session begins with no memory of what came before", so its harness keeps a progress file and version history for the next session to read ( [Effective harnesses for long-running agents](https://www.anthropic.com/engineering/effective-harnesses-for-long-running-agents) ). Fig. 04 What the model sees this turn, and what is stored outside it. Ask what gets stored, where, and who can read it later. An agent's memory of client details is a data store like any other, and your personal data rules still apply. GAI101 covers PDPA-aware handling of sensitive data in the same topic that introduces agent harnesses. ## 05 4. Permissions: who says yes Each action an agent can take should have one of three settings: it runs on its own, waits for a person to approve it, or is blocked. Reading a spreadsheet might run on its own, sending an email might wait for approval, and making a payment might be blocked. Agent toolkits such as the Claude Agent SDK let developers approve some tools in advance, block others outright, and send the remaining calls that need approval to an approval step. A refused call is reported to the model, which usually tries another approach or says it could not continue. What matters most is where the rule lives. IMDA's framework advises organisations to "prefer deterministic rather than non-deterministic limits, and bound by design. For example, rather than relying on prompts to instruct the agent against accessing certain tools, impose access controls that prevent the tool from being called by the agent at all." Writing "please don't email clients" in the instructions is a request. Removing the email tool is a rule. Fig. 05 Three permission settings for any action an agent can take. An approval only helps if the approver can judge the request. See [the 10-second AI approval test](https://www.metacamp.sg/journal/human-in-the-loop-ai-approval-test/) . ## 06 5. Evaluation: how you know it works One impressive demo tells you little. Test an agent as you would a new process: on many real cases where you already know the right answer. Anthropic's guide uses four plain terms ( [Demystifying evals for AI agents](https://www.anthropic.com/engineering/demystifying-evals-for-ai-agents) ): - A **task** , or test case, is "a single test with defined inputs and success criteria". - A **grader** is "logic that scores some aspect of the agent's performance". It can be a script, a rubric scored by a person, or another model acting as a judge. - A **transcript** , also called a trace, is "the complete record of a trial, including outputs, tool calls, reasoning, intermediate results". - An **evaluation harness** is "the infrastructure that runs evals end-to-end". The routine: 1. Collect real examples where the right answer is known. This is your golden set. 2. Write a rubric that says what a good answer looks like. 3. Run the agent on every case and grade the results. 4. Read the transcripts of the failures, not only the final answers. 5. After any change to the model, the prompt or the tools, run every case again. This re-run, a regression test, shows whether a fix in one place broke something elsewhere. 6. Decide whether to ship based on that evidence. Fig. 06 The evaluation routine: a test set, graders and a gate. Changing either the harness or the model means testing again. GAI201's Topic 05, The Evaluation Harness, is built around this routine: a 20-case golden set, a scorable rubric, human scores compared with an LLM-as-judge run, and "an evidence-backed ship or no-ship decision". ## 07 6. Containment: limiting the damage Even a well-tested agent will sometimes misread the task or be tricked. OWASP explains that "indirect prompt injections occur when an LLM accepts input from external sources, such as websites or files", which can carry hidden instructions ( [OWASP LLM01:2025](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) ). Containment keeps a mistake small: - **A separate workspace, or sandbox.** IMDA suggests "running agents in self-contained environments with limited network and data access, particularly when they are carrying out high-risk tasks such as code execution." - **One way out.** Only approved services and websites can be reached. - **Budgets.** Caps on turns, time and spend. - **A stop switch.** IMDA recommends "mechanisms and procedures to take agents offline". - **Logs and undo.** A record of every action, plus version history so a bad change can be rolled back. Anthropic's long-running harness uses git "to revert bad code changes and recover working states". Fig. 07 Containment: five layers that keep a mistake small. GAI201's Topic 06 practises these: a token budget, a retry limit, a kill switch, least-privilege tool permissions, and a human approval gate tested "with a poisoned-document injection drill". ## 08 Putting it together: one task, start to finish Say you ask an agent to send your team this week's sales summary. 1. **Memory.** The harness loads the instructions and the team's notes on how reports should look. 2. **Tools.** The model asks to read the sales sheet. Reading is allowed, so the harness runs it. 3. **Containment.** A line hidden in the sheet tells the agent to email the figures to an outside address. The model is fooled and asks to send it. A fixed rule against outside email blocks the request. 4. **Loop.** The model writes the summary. 5. **Permissions.** The model asks to email the sales team. Sending email is set to Ask, so the run pauses until a person approves. 6. **Loop.** The model gives its final answer and the run ends, well inside its turn limit. 7. **Evaluation.** Afterwards, you check the run record, not just the email that went out. Fig. 08 One run, step by step: a bad request blocked, an email approved. The model made one bad call and the outcome was still fine, because the harness had a rule waiting for exactly that mistake. ## 09 How the six parts map to the six-box test Our earlier post gives you six questions for any AI tool: Sees, Does, Remembers, Approves, Checks and Undoes. Each has a home in the harness, and the loop adds a seventh: when does it stop? Fig. 09 Metacamp's reading of where each six-box question is answered inside the harness. This mapping is Metacamp's reading, not an official crosswalk. | Question | Where the answer lives | | --- | --- | | Sees: what can it read? | Memory and context, plus any tools that read data | | Does: what can it change? | Tools, limited by permissions | | Remembers: what does it keep? | Memory | | Approves: who signs off? | Permissions | | Checks: how do we know it is right? | Evaluation | | Undoes: what is the undo? | Containment | | Stops: when does it end? | The loop and its limits | ## 10 Who needs to understand harnesses? Not only engineers. Who approves this, what does it keep about our clients, and what is the undo are management questions. IMDA's framework is "targeted at organisations looking to deploy agentic AI, whether by developing AI agents in-house or using third-party agentic solutions" ( [IMDA factsheet](https://www.imda.gov.sg/-/media/imda/files/news-and-events/media-room/media-releases/2026/01/factsheet-model-ai-governance-framework-for-agentic-ai.pdf) ). It covers four areas: assessing and bounding the risks upfront, making humans meaningfully accountable, putting technical controls and processes in place, and enabling end-user responsibility. If you are choosing or rolling out an AI tool, you do not have to build its harness. You do need to ask what each part does, and to recognise a good answer. ## 11 Where Metacamp teaches this Fig. 10 Where the harness is taught at Metacamp. **[GAI101 Applied Generative AI Fundamentals](https://www.metacamp.sg/courses/gai101/)** (TGS-2026065683) is for beginners with secondary education and no AI or coding experience: 18.5 hours over three full days or six half days, in person. Topic 04 extends a no-code workflow into "a guided multi-step agent" and tests "its hand-offs, guardrails and failure states". Topic 05 teaches "how an agent harness controls context, tools, permissions, memory and human review". **[GAI101F Applied Generative AI for Financial Services](https://www.metacamp.sg/courses/gai101f/)** (TGS-2026066964) covers the same ground for financial-services roles. Its Topic 04 sets up an agent "with a harness of instructions, memory, skills and approval rules around its model". **[GAI201 Applied Agentic AI Systems](https://www.metacamp.sg/courses/gai201/)** (TGS-2026067095) is the intermediate course. It needs GAI101, GAI101F or equivalent generative-AI experience, and also runs for 18.5 hours over three days, with no coding. You define tool permissions, wire bounded loops and approval gates, repair failing agent teams, build an evaluation harness, and finish with budgets, a kill switch and an injection drill. Autonomy is assigned "within the strength of the harness". Check the dates and timetable for the run you choose. **Fees and funding:** - Each course has a full fee of S$1,750. Metacamp is not GST-registered, so no GST is added. - For GAI101 and GAI201, the course pages list a 50% subsidy from SSG, now part of SWDA ( [IRAS](https://www.iras.gov.sg/schemes/disbursement-schemes/enterprise-innovation-scheme-(eis) )), which leaves S$875 to pay, or 70% for Singapore Citizens aged 40 and above (S$525). Permanent Residents get the 50% subsidy. - Metacamp lists GAI101F as supported under IBF-STS, subject to eligibility and completion. - Eligible Singapore Citizens aged 25 or over may put up to S$500 of their Opening SkillsFuture Credit towards the rest, which brings the fee down to as little as S$25. - The course pages currently say Mid-Career Credit cannot be used. For runs from 1 December 2026, check the specific course listing for the Mid-Career Credit label before relying on this. - A private GAI101 run for your team gets the same subsidies as a public run, provided it is the full 18.5-hour course as registered with SSG. See [Metacamp for Teams](https://www.metacamp.sg/teams/) . - Indicative fees checked 11 November 2026; course-run and learner eligibility apply; confirm at enrolment. ## 12 FAQ ### What is an AI agent harness? The software around an AI model that lets it work as an agent. Anthropic calls it "the system that enables a model to act as an agent". ### What are the main parts of an agent harness? Six: the loop, tools, memory and context, permissions, evaluation, and containment (a sandbox, budgets, a stop switch, logs and undo). ### What is the difference between an AI model and an agent harness? The model generates text and proposes what to do next. The harness decides what the model can see, which requests run, when a person must approve, and when to stop. The same model can be safe in one harness and risky in another. ### Is an agent harness the same as an agent SDK or framework? Not quite. An SDK or framework is a kit for building a harness. Anthropic's Claude Agent SDK, for example, provides "the same tools, agent loop, and context management that power Claude Code". You still choose the tools, permissions and limits for your own task. ### What is an evaluation harness? The setup that tests an agent from start to finish: it feeds in test cases, records transcripts, applies graders and reports the results. It is separate from the agent harness that does the work. ### How do you stop an AI agent from doing something harmful? Layer the controls. Give it only the tools it needs, require approval for risky actions, and block the rest in the harness, not in the prompt. Run it in a sandbox, cap its turns and spend, keep a stop switch, and log every action. ### Why are rules in the harness stronger than rules in the prompt? A prompt instruction can be ignored, lost when older context is summarised, or overridden by a prompt injection. A harness rule, such as removing a tool, is enforced by software every time. ### Does Singapore have guidance on AI agents? Yes. IMDA launched the Model AI Governance Framework for Agentic AI in January 2026, and version 1.5 was published on 20 May 2026. ### Do I need to code to understand or build an agent harness? No. Metacamp's GAI101 and GAI201 require no coding. ### Is GAI201 SkillsFuture funded? The course page lists GAI201 (TGS-2026067095) with a 50% SSG subsidy, or 70% for Singapore Citizens aged 40 and above, on a full fee of S$1,750. Course-run and learner eligibility apply; confirm at enrolment. Sources - Anthropic, [Demystifying evals for AI agents](https://www.anthropic.com/engineering/demystifying-evals-for-ai-agents) , 9 January 2026. - Anthropic, [Building effective agents](https://www.anthropic.com/engineering/building-effective-agents) , 19 December 2024. - Anthropic, [Effective harnesses for long-running agents](https://www.anthropic.com/engineering/effective-harnesses-for-long-running-agents) , 26 November 2025. - Anthropic, Claude Agent SDK documentation: [How the agent loop works](https://code.claude.com/docs/en/agent-sdk/agent-loop) , [Configure permissions](https://code.claude.com/docs/en/agent-sdk/permissions) and [Agent SDK overview](https://code.claude.com/docs/en/agent-sdk/overview) . - OpenAI, Agents SDK documentation: [Running agents](https://openai.github.io/openai-agents-python/running_agents/) . - Model Context Protocol, [What is the Model Context Protocol?](https://modelcontextprotocol.io/docs/getting-started/intro) - IMDA, [Model AI Governance Framework for Agentic AI, version 1.5](https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf) , published 20 May 2026, updated 5 June 2026. Core components are in section 1.1.1, and design limits are in section 2.1.2. - IMDA, [Factsheet: Model AI Governance Framework for Agentic AI](https://www.imda.gov.sg/-/media/imda/files/news-and-events/media-room/media-releases/2026/01/factsheet-model-ai-governance-framework-for-agentic-ai.pdf) and [launch press release](https://www.imda.gov.sg/resources/press-releases-factsheets-and-speeches/press-releases/2026/new-model-ai-governance-framework-for-agentic-ai) , January 2026. - OWASP GenAI Security Project, [LLM06:2025 Excessive Agency](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/) and [LLM01:2025 Prompt Injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) . - IRAS, [Enterprise Innovation Scheme (EIS)](https://www.iras.gov.sg/schemes/disbursement-schemes/enterprise-innovation-scheme-(eis) ), footnote 2, for the formation of SWDA on 1 July 2026 through a merger of SSG and Workforce Singapore. - Metacamp course pages: [GAI101](https://www.metacamp.sg/courses/gai101/) , [GAI101F](https://www.metacamp.sg/courses/gai101f/) and [GAI201](https://www.metacamp.sg/courses/gai201/) , and [Metacamp for Teams](https://www.metacamp.sg/teams/) . - Metacamp Journal: [The AI agent harness explained](https://www.metacamp.sg/journal/ai-agent-harness-explained/) (19 August 2026) and [Human in the loop is not enough: the 10-second AI approval test](https://www.metacamp.sg/journal/human-in-the-loop-ai-approval-test/) . Related entries - [Agentic thinking 19 AUG 2026 · 8 min read **The model is not the whole system**](https://www.metacamp.sg/journal/ai-agent-harness-explained/) - [Agentic thinking 23 JUL 2026 · 2 min read **Before you give an AI agent access**](https://www.metacamp.sg/journal/agent-containment-checklist/) - [Agentic thinking 23 JUL 2026 · 2 min read **Decide what your AI agent is allowed to do**](https://www.metacamp.sg/journal/agent-approval-matrix/) --- Metacamp is an AI academy in Singapore. Facts in one place: https://www.metacamp.sg/facts.md. Every page as Markdown: https://www.metacamp.sg/llms.txt. Contact: team@metacamp.sg.