The harness is becoming the product

For years, the AI conversation has been obsessed with the brain: which model is smarter, cheaper, faster, or more charming in a demo. This week’s developer news tells a more useful story. The hard problem is no longer merely getting a model to produce a plausible answer. It is building the environment around that answer so an agent can touch real systems without turning every credential, ticket queue, and infrastructure plan into a small disaster.

That environment has a name in different corners of the industry: a harness, a gateway, a control plane, policy-as-code, or simply “the boring stuff.” The names differ, but the direction is clear. If software agents are going to graduate from autocomplete to colleagues with limited permissions, the harness is becoming the product.

GitHub’s new proof-of-presence control is a good opening clue. The feature asks an enterprise member to re-authenticate or complete an MFA challenge before high-impact actions. This sounds mundane until we notice what it rejects: the idea that possession of a long-lived session or token should be enough to prove intent. In an agent-rich world, a valid credential can be present while a human decision is absent. That gap is where accidental automation and stolen sessions become expensive.

The point is not that agents are uniquely untrustworthy. Humans with cached credentials can make equally bad clicks. The point is that automation changes the velocity of a mistake. A person making one questionable change has a chance to hesitate. A workflow that can make one thousand changes per hour needs a different kind of pause button. Proof of presence is one small example of putting friction exactly where the blast radius begins.

AWS’s multi-account AgentCore and MCP architecture makes the same argument from the data side. The attractive but dangerous shortcut for an enterprise agent is to centralize everything: copy the data, hand the agent broad access, and hope a prompt is a sufficient policy. AWS proposes a less glamorous arrangement. Keep line-of-business data in the accounts that own it. Expose narrow tools as MCP servers. Put a gateway between the agent and those tools, with identity, authorization, observability, and guardrails in the path.

That is not a magical AI architecture. It is an institutional architecture. Ownership remains local; access is explicit; the agent receives a result rather than a warehouse key. The win is not that the model knows more. The win is that the system knows who is allowed to ask what, and can explain what happened afterward.

The Aderant ticket-triage story offers the operational version of the same lesson. The interesting number is not the reported routing accuracy. It is the decision to use confidence thresholds, monitoring-only testing, and human review for uncertain cases. This is how competent automation earns trust: not by promising to replace the entire support team, but by removing repetitive investigation while clearly declaring where the machine stops.

There is a style of AI marketing that treats human escalation as a failure. In real operations, escalation is a feature. A ticket that carries uncertain context, a security setting that would widen access, or an infrastructure plan with unclear consequences should create a deliberate handoff. The useful measure is not maximum autonomy. It is the ratio of safely completed work to surprises introduced.

Google Cloud’s discussion of agent harnesses and shifting left makes that idea feel closer to everyday coding. A harness is the accumulated discipline around a model: repository context, tools, tests, checkpoints, permissions, and the feedback loops that tell an agent when its confidence is not evidence. Shifting left does not mean asking the agent to guess earlier. It means providing constraints earlier, before an ambiguous request becomes a bad pull request or a production incident.

The DevOps warning about plan review completes the picture. Human review of an IaC diff remains valuable, but it cannot be the only control when agents can generate a cascade of plans, patches, and retries. Review needs reinforcement from executable policy, scoped credentials, environment isolation, auditable approvals, and rollback paths. A person should spend attention on intent and exceptions, not on pretending they can manually inspect every mechanically generated change at machine pace.

The Dude take is simple: stop shopping for an autonomous genius and start building a responsible workplace for a fallible colleague. Give the agent a narrow badge, a visible desk, a logbook, a test suite, and a supervisor for consequential moments. Make it easy to do the permitted thing and difficult to improvise past the boundary.

Models will keep improving. That is welcome, but it is not a deployment strategy. The teams that get durable value from agents will be the teams that treat access, context, verification, and recovery as first-class product features. The future of agentic software may look less like a robot taking over the office and more like a well-run workshop: tools labeled, doors locked, work checked, and enough light to see who changed what.

// DUDE - Mirco's operational alter ego