Contact Us

Agentic thinking · 14 min read

Field note 015Agentic thinking

How an AI agent harness works: the six parts around the model

A plain-language look inside the software that turns an AI model into a working agent.

An AI agent harness is the software around a language model that lets it carry out a task. It runs the loop, connects tools, manages memory and context, asks a person before risky steps, tests the work and limits the damage when something goes wrong. The model suggests the next step, and the harness decides whether it happens.

· Facts checked 11 November 2026

The short answer: an AI agent harness is the software around a language model that lets it carry out a task. It runs the model again and again until the task is done or a limit is hit, turns its requests into real actions such as searching files or sending email, decides what it sees and remembers, asks a person before risky steps, tests it on known cases before and after every change, and limits the damage when something goes wrong. The model suggests the next step, and the harness decides whether it happens. As Anthropic's engineers put it, when you evaluate an agent, "we're evaluating the harness and the model working together" (Anthropic, 2026).

The AI agent harness explained is our ten-minute, six-question map for judging any AI tool. This guide opens the harness up.

01What is an agent harness?

A language model on its own does one thing: text goes in and text comes out. It cannot open your files, send an email or remember yesterday's conversation. The harness is the software added around it to make a working agent, so every agent is a model plus a harness. It is ordinary software: rules, settings and code that people write and can inspect.

Anthropic defines an agent harness, or scaffold, as "the system that enables a model to act as an agent" (Demystifying evals for AI agents). Singapore's Model AI Governance Framework for Agentic AI, published by IMDA, lists the same building blocks: instructions, memory, planning, tools, protocols for connecting tools, controls ("access controls, guardrails, human approvals") and logging (IMDA, version 1.5).

One model, six harness parts around it A hexagon with the model at its centre, marked text in, text out. Each of the six sides is one part of the harness, with the question it answers. 1 The loop: when does it stop? 2 Tools: what can it actually do? 3 Memory and context: what does it see and keep? 4 Permissions: who says yes? 5 Evaluation: how do we know it works? 6 Containment: what is the worst case, and can we reverse it? Anatomy of a harness One model, six harness parts around it 01 02 03 04 05 06 Model Text in, text out 01 The loop When does it stop? 02 Tools What can it actually do? 03 Memory and context What does it see and keep? 04 Permissions Who says yes? 05 Evaluation How do we know it works? 06 Containment What is the worst case, and can we reverse it?
One model, six harness parts around it A hexagon with the model at its centre, marked text in, text out. Each of the six sides is one part of the harness, with the question it answers. 1 The loop: when does it stop? 2 Tools: what can it actually do? 3 Memory and context: what does it see and keep? 4 Permissions: who says yes? 5 Evaluation: how do we know it works? 6 Containment: what is the worst case, and can we reverse it? Anatomy of a harness One model, six harness parts around it 01 02 03 04 05 06 Model Text in, text out 01 The loop When does it stop? 02 Tools What can it actually do? 03 Memory and context What does it see and keep? 04 Permissions Who says yes? 05 Evaluation How do we know it works? 06 Containment What is the worst case, and can we reverse it?
Fig. 01One model, six harness parts around it.

021. The loop: how an agent keeps going

A chatbot answers once and stops. An agent works in a loop: Anthropic describes agents as "typically just LLMs using tools based on environmental feedback in a loop" (Building effective agents). The Claude Agent SDK documentation sets out the cycle: Claude "evaluates your prompt, calls tools to take action, receives the results, and repeats until the task is complete" (How the agent loop works). OpenAI's Agents SDK documents the same cycle (Running agents).

  1. The harness puts together what the model will see: its instructions, the task, any relevant memory and everything so far.

  2. The model replies with either a final answer or a request to use a tool.

  3. The harness checks the request against its rules. If it is allowed, the harness runs it and records it.

  4. The result goes back to the model, and the cycle starts again.

There are two ways out. One is a final answer with no more tool requests. The other is a limit: the harness can cap the turns or the spend, and a person can stop the run. Anthropic recommends "stopping conditions (such as a maximum number of iterations)", and the SDK documentation notes that without limits the loop "runs until Claude finishes on its own".

The agent loop: four stations and two exits A closed track with four stations, run clockwise. 1 The harness puts together what the model will see. 2 The model replies with a final answer or a tool request. 3 The harness checks the request, runs it if allowed and records it. 4 The result goes back to the model, and the cycle starts again. There are two ways out. Final answer: no more tool requests, so the run ends. Limit: a cap on turns or spend, or a person stops the run. The harness runs three of the four stations. Part 1, the loop Four stations and two ways out 01 02 03 04 Final answer Limit One turn 01 The harness puts together what the model will see 02 The model replies with a final answer or a tool request 03 The harness checks the request, runs it if allowed and records it 04 The result goes back to the model Two ways out Final answer No more tool requests, so the run ends Limit A cap on turns or spend, or a person stops the run The harness runs three of the four stations.
The agent loop: four stations and two exits A closed track with four stations, run clockwise. 1 The harness puts together what the model will see. 2 The model replies with a final answer or a tool request. 3 The harness checks the request, runs it if allowed and records it. 4 The result goes back to the model, and the cycle starts again. There are two ways out. Final answer: no more tool requests, so the run ends. Limit: a cap on turns or spend, or a person stops the run. The harness runs three of the four stations. Part 1, the loop Four stations and two ways out 01 02 03 04 Final answer Limit One turn 01 The harness puts together what the model will see 02 The model replies with a final answer or a tool request 03 The harness checks the request, runs it if allowed and records it 04 The result goes back to the model Two ways out Final answer No more tool requests, so the run ends Limit A cap on turns or spend, or a person stops the run The harness runs three of the four stations.
Fig. 02The agent loop: four stations and two exits.

A loop with no limit can repeat a mistake or keep spending money. Diagnosing agents that "loop, stall or produce confidently wrong output" is a full topic in GAI201.

032. Tools: how a model "does" things

The model never presses a button itself. To search a folder, it writes a structured request with the tool's name and its inputs. The harness reads the request, decides whether it is allowed and, if so, runs it.

IMDA's framework says tools let an agent "take actions and interact with other systems, such as writing to files and databases, controlling devices, or performing transactions". Standard connectors such as the Model Context Protocol (MCP), "an open-source standard for connecting AI applications to external systems", let one harness plug into many tools (MCP documentation). The Agent SDK documentation puts the division of labour this way: "Claude determines which tools to call based on the task, but you control whether those calls are allowed to execute."

One tool call, message by message Three lifelines: the model, the harness and the tool. 1 The model writes a structured request with the tool name and its inputs. 2 The harness reads it and decides whether it is allowed. 3 The harness runs the call. 4 The tool returns the result. 5 The harness passes the result back to the model. If the call is refused, it never reaches the tool: the harness tells the model, which usually tries another approach or reports that it could not continue. The model never presses a button itself. Part 2, tools One tool call, message by message Model Harness Tool Writes a structured request Tool name and inputs Reads it and decides whether it is allowed Runs the call Returns the result Passes the result back 01 02 03 04 05 If the call is refused It never reaches the tool Tells the model it was refused The model usually tries another approach or reports that it could not continue. The model never presses a button itself.
One tool call, message by message Three lifelines: the model, the harness and the tool. 1 The model writes a structured request with the tool name and its inputs. 2 The harness reads it and decides whether it is allowed. 3 The harness runs the call. 4 The tool returns the result. 5 The harness passes the result back to the model. If the call is refused, it never reaches the tool: the harness tells the model, which usually tries another approach or reports that it could not continue. The model never presses a button itself. Part 2, tools One tool call, message by message Model Harness Tool 01 The model writes a structured request Tool name and inputs 02 The harness reads it and decides whether it is allowed 03 The harness runs the call 04 The tool returns the result 05 The harness passes the result back to the model If the call is refused The harness tells the model the call was refused. The model usually tries another approach or reports that it could not continue. The model never presses a button itself.
Fig. 03One tool call, message by message.

Fewer, narrower tools mean less risk. The OWASP GenAI Security Project lists "excessive agency" among the top risks for AI applications and advises limiting the extensions an agent can call "to only the minimum necessary" (OWASP LLM06:2025). A tool that only reads your calendar is safer than one with full access to your email.

043. Memory and context: what the agent sees and keeps

The model keeps nothing between requests. On every turn the harness lays out everything the model can see: the context window. The Agent SDK documentation lists its contents as the system prompt, tool definitions, the conversation history, and tool inputs and outputs. "Everything accumulates."

The window has a fixed size. As it nears its limit, the harness summarises older parts of the conversation, a step called compaction. The documentation warns that "specific instructions from early in the conversation may not be preserved", so rules that must always apply belong in a file loaded on every request.

Long-term memory lives outside the model: notes files, a document library searched when needed (retrieval-augmented generation, or RAG), saved preferences and records of past sessions. Anthropic notes that "each new session begins with no memory of what came before", so its harness keeps a progress file and version history for the next session to read (Effective harnesses for long-running agents).

What the model sees this turn, and what is stored outside it On one side, the context window: a box of fixed size that fills from the top with the system prompt, tool definitions, the conversation history and tool inputs and outputs. When it nears its limit, older turns are replaced by a summary, a step called compaction. A file of rules that must always apply is loaded on every request. On the other side, memory stored outside the model: notes files, a document library searched when needed (RAG), saved preferences and records of past sessions. Nothing stored reaches the model unless the harness brings it in. The model keeps nothing between requests, and a new session begins with no memory of what came before. Part 3, memory and context What the model sees, and what is kept outside it Context window, this turn System prompt Tool definitions Compaction Summary of older turns Conversation history Tool inputs and outputs Room left Fixed size Loaded on every request A file of rules that must always apply Stored outside the model Notes files A document library, searched when needed RAG Saved preferences Records of past sessions Nothing stored reaches the model unless the harness brings it in. The model keeps nothing between requests. A new session begins with no memory of what came before.
What the model sees this turn, and what is stored outside it On one side, the context window: a box of fixed size that fills from the top with the system prompt, tool definitions, the conversation history and tool inputs and outputs. When it nears its limit, older turns are replaced by a summary, a step called compaction. A file of rules that must always apply is loaded on every request. On the other side, memory stored outside the model: notes files, a document library searched when needed (RAG), saved preferences and records of past sessions. Nothing stored reaches the model unless the harness brings it in. The model keeps nothing between requests, and a new session begins with no memory of what came before. Part 3, memory and context What the model sees, and what is kept outside it Context window, this turn System prompt Tool definitions Compaction Summary of older turns Conversation history Tool inputs and outputs Room left Fixed size Loaded on every request A file of rules that must always apply Stored outside the model Notes files A document library, searched when needed RAG Saved preferences Records of past sessions Nothing stored reaches the model unless the harness brings it in. The model keeps nothing between requests. A new session begins with no memory of what came before.
Fig. 04What the model sees this turn, and what is stored outside it.

Ask what gets stored, where, and who can read it later. An agent's memory of client details is a data store like any other, and your personal data rules still apply. GAI101 covers PDPA-aware handling of sensitive data in the same topic that introduces agent harnesses.

054. Permissions: who says yes

Each action an agent can take should have one of three settings: it runs on its own, waits for a person to approve it, or is blocked. Reading a spreadsheet might run on its own, sending an email might wait for approval, and making a payment might be blocked.

Agent toolkits such as the Claude Agent SDK let developers approve some tools in advance, block others outright, and send the remaining calls that need approval to an approval step. A refused call is reported to the model, which usually tries another approach or says it could not continue.

What matters most is where the rule lives. IMDA's framework advises organisations to "prefer deterministic rather than non-deterministic limits, and bound by design. For example, rather than relying on prompts to instruct the agent against accessing certain tools, impose access controls that prevent the tool from being called by the agent at all." Writing "please don't email clients" in the instructions is a request. Removing the email tool is a rule.

Three permission settings for any action an agent can take One request from the model reaches the harness, which switches it one of three ways. Runs on its own: for example, reading a spreadsheet. Waits for a person: for example, sending an email. Blocked: for example, making a payment. When a call is refused, the model is told, and it usually tries another approach or reports that it could not continue. Where the rule lives matters. In the prompt, please do not email clients is a request, which can be ignored, lost or overridden. In the harness, removing the email tool is a rule that software enforces every time. Part 4, permissions One request, three possible settings Request Harness Runs on its own Reading a spreadsheet, for example Waits for a person Sending an email, for example Blocked Making a payment, for example When a call is refused, the model is told. It usually tries another approach or reports that it could not continue. Where the rule lives In the prompt Please do not email clients A request. It can be ignored, lost or overridden. In the harness The email tool is removed A rule. Software enforces it every time.
Three permission settings for any action an agent can take One request from the model reaches the harness, which switches it one of three ways. Runs on its own: for example, reading a spreadsheet. Waits for a person: for example, sending an email. Blocked: for example, making a payment. When a call is refused, the model is told, and it usually tries another approach or reports that it could not continue. Where the rule lives matters. In the prompt, please do not email clients is a request, which can be ignored, lost or overridden. In the harness, removing the email tool is a rule that software enforces every time. Part 4, permissions One request, three possible settings Request from the model Harness Runs on its own Reading a spreadsheet, for example Waits for a person Sending an email, for example Blocked Making a payment, for example When a call is refused, the model is told. It usually tries another approach or reports that it could not continue. Where the rule lives In the prompt Please do not email clients A request. It can be ignored, lost or overridden. In the harness The email tool is removed A rule. Software enforces it every time.
Fig. 05Three permission settings for any action an agent can take.

An approval only helps if the approver can judge the request. See the 10-second AI approval test.

065. Evaluation: how you know it works

One impressive demo tells you little. Test an agent as you would a new process: on many real cases where you already know the right answer.

Anthropic's guide uses four plain terms (Demystifying evals for AI agents):

  • A task, or test case, is "a single test with defined inputs and success criteria".
  • A grader is "logic that scores some aspect of the agent's performance". It can be a script, a rubric scored by a person, or another model acting as a judge.
  • A transcript, also called a trace, is "the complete record of a trial, including outputs, tool calls, reasoning, intermediate results".
  • An evaluation harness is "the infrastructure that runs evals end-to-end".

The routine:

  1. Collect real examples where the right answer is known. This is your golden set.

  2. Write a rubric that says what a good answer looks like.

  3. Run the agent on every case and grade the results.

  4. Read the transcripts of the failures, not only the final answers.

  5. After any change to the model, the prompt or the tools, run every case again. This re-run, a regression test, shows whether a fix in one place broke something elsewhere.

  6. Decide whether to ship based on that evidence.

The evaluation routine: a test set, graders and a gate A line of five stages. Golden set: real cases where the right answer is known. Run: the agent runs every case. Transcripts: the complete record of each trial. Graders: a script, a person with a rubric, or a model as judge. Gate: ship or not, decided on the evidence. The first four stages together are the evaluation harness, the infrastructure that runs evals end-to-end. A return path leads from the gate back to the start: after any change to the model, the prompt or the tools, run every case again. This is a regression test. Part 5, evaluation A test set, graders and a gate Evaluation harness, the infrastructure that runs evals end-to-end Golden set Real cases where the right answer is known Run The agent runs every case Transcripts The complete record of each trial Graders A script, a person with a rubric, or a model as judge Gate Ship or not, decided on the evidence Regression test After any change to the model, the prompt or the tools, run every case again.
The evaluation routine: a test set, graders and a gate A line of five stages. Golden set: real cases where the right answer is known. Run: the agent runs every case. Transcripts: the complete record of each trial. Graders: a script, a person with a rubric, or a model as judge. Gate: ship or not, decided on the evidence. The first four stages together are the evaluation harness, the infrastructure that runs evals end-to-end. A return path leads from the gate back to the start: after any change to the model, the prompt or the tools, run every case again. This is a regression test. Part 5, evaluation A test set, graders and a gate Evaluation harness, the infrastructure that runs evals end-to-end Golden set Real cases where the right answer is known Run The agent runs every case Transcripts The complete record of each trial Graders A script, a person with a rubric, or a model as judge Gate Ship or not, decided on the evidence Regression test After any change to the model, the prompt or the tools, run every case again.
Fig. 06The evaluation routine: a test set, graders and a gate.

Changing either the harness or the model means testing again. GAI201's Topic 05, The Evaluation Harness, is built around this routine: a 20-case golden set, a scorable rubric, human scores compared with an LLM-as-judge run, and "an evidence-backed ship or no-ship decision".

076. Containment: limiting the damage

Even a well-tested agent will sometimes misread the task or be tricked. OWASP explains that "indirect prompt injections occur when an LLM accepts input from external sources, such as websites or files", which can carry hidden instructions (OWASP LLM01:2025). Containment keeps a mistake small:

  • A separate workspace, or sandbox. IMDA suggests "running agents in self-contained environments with limited network and data access, particularly when they are carrying out high-risk tasks such as code execution."
  • One way out. Only approved services and websites can be reached.
  • Budgets. Caps on turns, time and spend.
  • A stop switch. IMDA recommends "mechanisms and procedures to take agents offline".
  • Logs and undo. A record of every action, plus version history so a bad change can be rolled back. Anthropic's long-running harness uses git "to revert bad code changes and recover working states".
Containment: five layers that keep a mistake small A floor plan of a walled room with the agent inside. 1 The walls are a separate workspace, or sandbox, with limited network and data access. 2 One door: only approved services and websites can be reached. 3 Budgets: caps on turns, time and spend. 4 A stop switch on the outside wall: a way to take the agent offline. 5 Logs and undo: a record of every action leaves the room, and version history can roll back a bad change. Part 6, containment Five layers that keep a mistake small 01 02 Agent 03 04 05 01 A separate workspace, or sandbox Limited network and data access 02 One way out Only approved services and websites can be reached 03 Budgets Caps on turns, time and spend 04 A stop switch A way to take the agent offline 05 Logs and undo A record of every action, and version history to roll back a bad change
Containment: five layers that keep a mistake small A floor plan of a walled room with the agent inside. 1 The walls are a separate workspace, or sandbox, with limited network and data access. 2 One door: only approved services and websites can be reached. 3 Budgets: caps on turns, time and spend. 4 A stop switch on the outside wall: a way to take the agent offline. 5 Logs and undo: a record of every action leaves the room, and version history can roll back a bad change. Part 6, containment Five layers that keep a mistake small 01 02 Agent 03 04 05 01 A separate workspace, or sandbox Limited network and data access 02 One way out Only approved services and websites can be reached 03 Budgets Caps on turns, time and spend 04 A stop switch A way to take the agent offline 05 Logs and undo A record of every action, and version history to roll back a bad change
Fig. 07Containment: five layers that keep a mistake small.

GAI201's Topic 06 practises these: a token budget, a retry limit, a kill switch, least-privilege tool permissions, and a human approval gate tested "with a poisoned-document injection drill".

08Putting it together: one task, start to finish

Say you ask an agent to send your team this week's sales summary.

  1. Memory.

    The harness loads the instructions and the team's notes on how reports should look.

  2. Tools.

    The model asks to read the sales sheet. Reading is allowed, so the harness runs it.

  3. Containment.

    A line hidden in the sheet tells the agent to email the figures to an outside address. The model is fooled and asks to send it. A fixed rule against outside email blocks the request.

  4. Loop.

    The model writes the summary.

  5. Permissions.

    The model asks to email the sales team. Sending email is set to Ask, so the run pauses until a person approves.

  6. Loop.

    The model gives its final answer and the run ends, well inside its turn limit.

  7. Evaluation.

    Afterwards, you check the run record, not just the email that went out.

One run, step by step: a bad request blocked, an email approved The path of one illustrative run, asked to send the team this week's sales summary. 1 Memory: the harness loads the instructions and the team's notes on reports. 2 Tools: the model asks to read the sales sheet, and reading is allowed. 3 Containment: a line hidden in the sheet says to email an outside address; the model asks to send it and a fixed rule blocks the request. 4 Loop: the model writes the summary. 5 Permissions: emailing the sales team is set to ask, so the run pauses until a person approves. 6 Loop: final answer, and the run ends inside its turn limit. 7 Evaluation: afterwards, the run record is what gets checked. The model made one bad call and the outcome was still fine, because the harness had a rule waiting for that mistake. Illustrative run One bad call, caught by a rule 01 Memory The harness loads the instructions and the team notes on reports 02 Tools The model asks to read the sales sheet. Reading is allowed. Blocked 03 Containment A hidden line says to email an outside address. A fixed rule blocks it. 04 Loop The model writes the summary 05 Permissions Emailing the sales team is set to ask. A person approves. 06 Loop Final answer. The run ends inside its turn limit. 07 Evaluation Afterwards, the run record is what gets checked The model made one bad call. The outcome was still fine, because the harness had a rule waiting for that mistake.
One run, step by step: a bad request blocked, an email approved The path of one illustrative run, asked to send the team this week's sales summary. 1 Memory: the harness loads the instructions and the team's notes on reports. 2 Tools: the model asks to read the sales sheet, and reading is allowed. 3 Containment: a line hidden in the sheet says to email an outside address; the model asks to send it and a fixed rule blocks the request. 4 Loop: the model writes the summary. 5 Permissions: emailing the sales team is set to ask, so the run pauses until a person approves. 6 Loop: final answer, and the run ends inside its turn limit. 7 Evaluation: afterwards, the run record is what gets checked. The model made one bad call and the outcome was still fine, because the harness had a rule waiting for that mistake. Illustrative run One bad call, caught by a rule 01 Memory The harness loads the instructions and the team notes on reports 02 Tools The model asks to read the sales sheet. Reading is allowed. 03 Containment Blocked A hidden line says to email an outside address. A fixed rule blocks it. 04 Loop The model writes the summary 05 Permissions Emailing the sales team is set to ask. A person approves. 06 Loop Final answer. The run ends inside its turn limit. 07 Evaluation Afterwards, the run record is what gets checked The model made one bad call. The outcome was still fine, because the harness had a rule waiting for that mistake.
Fig. 08One run, step by step: a bad request blocked, an email approved.

The model made one bad call and the outcome was still fine, because the harness had a rule waiting for exactly that mistake.

09How the six parts map to the six-box test

Our earlier post gives you six questions for any AI tool: Sees, Does, Remembers, Approves, Checks and Undoes. Each has a home in the harness, and the loop adds a seventh: when does it stop?

Metacamp's reading of where each six-box question is answered inside the harness An editorial mapping by Metacamp, not an official crosswalk. Seven questions linked to the six harness parts. Sees, what can it read: memory and context, plus any tools that read data. Does, what can it change: tools, limited by permissions. Remembers, what does it keep: memory. Approves, who signs off: permissions. Checks, how do we know it is right: evaluation. Undoes, what is the undo: containment. Stops, when does it end: the loop and its limits. Stops is the seventh question, added by the loop. Metacamp's reading of the six-box map Seven questions, and the part that answers each Sees What can it read? Does What can it change? Remembers What does it keep? Approves Who signs off? Checks How do we know it is right? Undoes What is the undo? Stops When does it end? 01 The loop 02 Tools 03 Memory and context 04 Permissions 05 Evaluation 06 Containment Where the answer lives Also involved Stops is the seventh question
Metacamp's reading of where each six-box question is answered inside the harness An editorial mapping by Metacamp, not an official crosswalk. Seven questions linked to the six harness parts. Sees, what can it read: memory and context, plus any tools that read data. Does, what can it change: tools, limited by permissions. Remembers, what does it keep: memory. Approves, who signs off: permissions. Checks, how do we know it is right: evaluation. Undoes, what is the undo: containment. Stops, when does it end: the loop and its limits. Stops is the seventh question, added by the loop. Metacamp's reading of the six-box map Seven questions, and the part that answers each Sees What can it read? Memory and context Tools Does What can it change? Tools Permissions Remembers What does it keep? Memory and context Approves Who signs off? Permissions Checks How do we know it is right? Evaluation Undoes What is the undo? Containment Stops When does it end? The loop Where the answer lives Also involved Stops is the seventh question
Fig. 09Metacamp's reading of where each six-box question is answered inside the harness.

This mapping is Metacamp's reading, not an official crosswalk.

QuestionWhere the answer lives
Sees: what can it read?Memory and context, plus any tools that read data
Does: what can it change?Tools, limited by permissions
Remembers: what does it keep?Memory
Approves: who signs off?Permissions
Checks: how do we know it is right?Evaluation
Undoes: what is the undo?Containment
Stops: when does it end?The loop and its limits

10Who needs to understand harnesses?

Not only engineers. Who approves this, what does it keep about our clients, and what is the undo are management questions. IMDA's framework is "targeted at organisations looking to deploy agentic AI, whether by developing AI agents in-house or using third-party agentic solutions" (IMDA factsheet). It covers four areas: assessing and bounding the risks upfront, making humans meaningfully accountable, putting technical controls and processes in place, and enabling end-user responsibility.

If you are choosing or rolling out an AI tool, you do not have to build its harness. You do need to ask what each part does, and to recognise a good answer.

11Where Metacamp teaches this

Where the harness is taught at Metacamp Three courses, each drawn as its six topics, with the topics that teach the harness filled in. GAI101 Applied Generative AI Fundamentals (TGS-2026065683, beginner, 18.5 hours, no coding): topic 4 extends a workflow into a guided multi-step agent and tests its hand-offs, guardrails and failure states; topic 5 covers how an agent harness controls context, tools, permissions, memory and human review. GAI101F Applied Generative AI for Financial Services (TGS-2026066964, beginner, 18.5 hours, no coding): topic 4 sets up an AI agent with a harness of instructions, memory, skills and approval rules around its model; topic 5 connects calendar, email and notes apps with the narrowest access and tests the limits. GAI201 Applied Agentic AI Systems (TGS-2026067095, intermediate, 18.5 hours, no coding): all six topics, covering the role as a system, tool permissions, bounded loops and approval gates, agents that loop or stall, a 20-case golden set with a rubric, and a token budget, retry limit and kill switch. The wording is from the course outlines. Where Metacamp teaches this Two topics in each beginner course, all six in GAI201 GAI101 Applied Generative AI Fundamentals TGS-2026065683 · Beginner · 18.5 hours · No coding Topic 04 Extend the workflow into a guided multi-step agent and test its hand-offs, guardrails and failure states. Topic 05 Understand how an agent harness controls context, tools, permissions, memory and human review. GAI101F Applied Generative AI for Financial Services TGS-2026066964 · Beginner · 18.5 hours · No coding Topic 04 Set up an AI agent on its own cloud computer, with a harness of instructions, memory, skills and approval rules around its model. Topic 05 Connect your calendar, email and notes apps to the agent with the narrowest access, then test its limits. GAI201 Applied Agentic AI Systems TGS-2026067095 · Intermediate · 18.5 hours · No coding Topic 01 Map recurring responsibilities across memory, routines, reactive agents, an on-demand harness and governance. Topic 02 Define tool permissions and identify when each pattern is the wrong shape for the work. Topic 03 Wire the graph in n8n with routing, a parallel join, a bounded loop, an approval gate, an error edge and a sub-workflow. Topic 04 Diagnose seeded teams that loop, stall or produce confidently wrong output. Topic 05 Build a 20-case golden set from realistic work inputs and define a scorable rubric. Topic 06 Set a token budget, retry limit, kill switch and least-privilege tool permissions. Wording from the course outlines.
Where the harness is taught at Metacamp Three courses, each drawn as its six topics, with the topics that teach the harness filled in. GAI101 Applied Generative AI Fundamentals (TGS-2026065683, beginner, 18.5 hours, no coding): topic 4 extends a workflow into a guided multi-step agent and tests its hand-offs, guardrails and failure states; topic 5 covers how an agent harness controls context, tools, permissions, memory and human review. GAI101F Applied Generative AI for Financial Services (TGS-2026066964, beginner, 18.5 hours, no coding): topic 4 sets up an AI agent with a harness of instructions, memory, skills and approval rules around its model; topic 5 connects calendar, email and notes apps with the narrowest access and tests the limits. GAI201 Applied Agentic AI Systems (TGS-2026067095, intermediate, 18.5 hours, no coding): all six topics, covering the role as a system, tool permissions, bounded loops and approval gates, agents that loop or stall, a 20-case golden set with a rubric, and a token budget, retry limit and kill switch. The wording is from the course outlines. Where Metacamp teaches this Two topics in each beginner course, all six in GAI201 GAI101 Applied Generative AI Fundamentals TGS-2026065683 Beginner · 18.5 hours · No coding Topic 04 Extend the workflow into a guided multi-step agent and test its hand-offs, guardrails and failure states. Topic 05 Understand how an agent harness controls context, tools, permissions, memory and human review. GAI101F Applied Generative AI for Financial Services TGS-2026066964 Beginner · 18.5 hours · No coding Topic 04 Set up an AI agent on its own cloud computer, with a harness of instructions, memory, skills and approval rules around its model. Topic 05 Connect your calendar, email and notes apps to the agent with the narrowest access, then test its limits. GAI201 Applied Agentic AI Systems TGS-2026067095 Intermediate · 18.5 hours · No coding Topic 01 Map recurring responsibilities across memory, routines, reactive agents, an on-demand harness and governance. Topic 02 Define tool permissions and identify when each pattern is the wrong shape for the work. Topic 03 Wire the graph in n8n with routing, a parallel join, a bounded loop, an approval gate, an error edge and a sub-workflow. Topic 04 Diagnose seeded teams that loop, stall or produce confidently wrong output. Topic 05 Build a 20-case golden set from realistic work inputs and define a scorable rubric. Topic 06 Set a token budget, retry limit, kill switch and least-privilege tool permissions. Wording from the course outlines.
Fig. 10Where the harness is taught at Metacamp.

[GAI101 Applied Generative AI Fundamentals](https://www.metacamp.sg/courses/gai101/) (TGS-2026065683) is for beginners with secondary education and no AI or coding experience: 18.5 hours over three full days or six half days, in person. Topic 04 extends a no-code workflow into "a guided multi-step agent" and tests "its hand-offs, guardrails and failure states". Topic 05 teaches "how an agent harness controls context, tools, permissions, memory and human review".

[GAI101F Applied Generative AI for Financial Services](https://www.metacamp.sg/courses/gai101f/) (TGS-2026066964) covers the same ground for financial-services roles. Its Topic 04 sets up an agent "with a harness of instructions, memory, skills and approval rules around its model".

[GAI201 Applied Agentic AI Systems](https://www.metacamp.sg/courses/gai201/) (TGS-2026067095) is the intermediate course. It needs GAI101, GAI101F or equivalent generative-AI experience, and also runs for 18.5 hours over three days, with no coding. You define tool permissions, wire bounded loops and approval gates, repair failing agent teams, build an evaluation harness, and finish with budgets, a kill switch and an injection drill. Autonomy is assigned "within the strength of the harness". Check the dates and timetable for the run you choose.

Fees and funding:

  • Each course has a full fee of S$1,750. Metacamp is not GST-registered, so no GST is added.
  • For GAI101 and GAI201, the course pages list a 50% subsidy from SSG, now part of SWDA (IRAS)), which leaves S$875 to pay, or 70% for Singapore Citizens aged 40 and above (S$525). Permanent Residents get the 50% subsidy.
  • Metacamp lists GAI101F as supported under IBF-STS, subject to eligibility and completion.
  • Eligible Singapore Citizens aged 25 or over may put up to S$500 of their Opening SkillsFuture Credit towards the rest, which brings the fee down to as little as S$25.
  • The course pages currently say Mid-Career Credit cannot be used. For runs from 1 December 2026, check the specific course listing for the Mid-Career Credit label before relying on this.
  • A private GAI101 run for your team gets the same subsidies as a public run, provided it is the full 18.5-hour course as registered with SSG. See Metacamp for Teams.
  • Indicative fees checked 11 November 2026; course-run and learner eligibility apply; confirm at enrolment.

12FAQ

The software around an AI model that lets it work as an agent. Anthropic calls it "the system that enables a model to act as an agent".