Harnesses: the controls that make AI safe to put to work

What a harness is

You would not hand a new senior hire the keys to every system on day one, with no job description, no spending limit and nobody reviewing their work. With AI agents it is easy to do exactly that.

An AI model is the engine that reads a request and writes a response. An agent is software built on a model that can also take actions, such as sending an email, updating a customer record or running a payment file. A harness is the set of rules, tools, checks and limits wrapped around a model or agent so that it behaves as intended.

The word is used in engineering for the scaffolding that runs software under controlled conditions, and I find the idea carries over well. Within its job the agent keeps its full power. The harness decides what the job is, and keeps the agent inside it.

Design, use and deployment

A harness has three stages, and mistakes are possible at each.

Design is deciding the job: what the agent is for, what it must never do, which information it may see and who approves what. Use is the harness at work on every request, offering the agent only the tools it needs and checking what comes back. Deployment is putting that design into the live environment, fitting it to each team's actual processes, testing it, and keeping it current as models, policies and people change.

Most of the failures I see described in public are not failures of the model. They are failures at one of these three stages.

What a harness does

In a business setting I look for six functions. A good harness provides all of them.

• Scope. It states what the agent is for and what it is not for.
• Access. It grants only the systems and data the task needs, and whether the agent may read, write or both. Engineers call this least privilege.
• Checks. It tests output before it is released, against policy and, where appropriate, by a second check.
• Limits. It caps spend, the number of actions and the time taken, and stops when a cap is reached.
• Approvals. It routes consequential actions to a named person before they happen.
• Record. It keeps a dated account of what was asked, what was done and who approved it.

What happens without one

Without a harness, a model does what it is asked, as helpfully as it can. It has no sense of its remit. I would describe the risks by mechanism.

Agents act outside their remit. If an agent can reach a system, it may use it. The industry body OWASP lists excessive agency among the top risks for applications built on large language models in 2025: giving a system more functions, permissions or autonomy than its task needs.

There is no record. When something goes wrong, nobody can show what was asked or why. Output varies from one run to the next. Costs have no ceiling.

Two public cases show the pattern. In February 2024 a Canadian tribunal held Air Canada responsible for wrong information its website chatbot gave a customer about bereavement fares, and found the airline had not taken reasonable care to make sure the chatbot was accurate. It was a small claim and not binding precedent, but the principle is clear: a business answers for what its AI says.

In July 2025, Fortune and others reported that an AI coding agent deleted a live database during a public trial, despite the user's instruction to freeze changes. The provider called it unacceptable and said it would separate development and live databases. The lesson I draw is that an instruction in a prompt is a request. A harness turns the freeze into a limit.

How a harness helps an enterprise

For a board or an executive team, the benefits translate into plain questions they can ask.

Control: who has authority to do what, and is it enforced? Governance: do our policies exist in the system as well as in a document? Repeatability: does the same task produce acceptable work each time? Auditability: can we show a regulator or customer what happened? Human oversight: which decisions always reach a person? Safer scaling: can we add a tenth agent without adding a tenth set of risks?

The last matters most for commercial reasons. Gartner forecast in June 2025 that over 40% of agentic AI projects would be cancelled by the end of 2027, citing rising costs, unclear business value and inadequate risk controls. That is a prediction, not a measurement, but it names the same three gaps a harness addresses.

Building a harness and deploying one well

These are different jobs. Model providers and agent platform vendors build harnesses, and engineering teams can build their own. The design choices are real engineering.

Most businesses need something different: a sound design chosen from proven practice, fitted to their own policies, deployed where the work happens, and then operated. Operating means keeping rules current, reviewing exceptions, and noticing when behaviour drifts.

GenWA are harness deployment and implementation specialists. We do not claim to build the AI harness itself. Our contribution is the best-practice design, the deployment into your environment, and the operating discipline.

How GenWA helps

Guard is where we enforce your rules and approvals on the AI used through GenWA, with named people signing off consequential actions. The GenWA Toolkit is our own collection of tools, maintained and upgraded, and it includes harnesses that supplement those you already have. Evidence keeps the record, so you can show what happened and who approved it.

The boundary matters. Our control applies to AI used through GenWA. It does not extend to tools outside it. Some parts, such as plain-English rule writing and drift detection, are being built.

What to do on Monday

Five questions to put to whoever runs your AI work.

• List every AI agent in use and write one line on its job and its limits.
• Check what each agent can access, and remove anything its task does not need.
• Identify which actions would need a named person's approval, and whether that happens in the system or only on paper.
• Ask whether you could produce, today, a record of what one agent did last week.
• Set a spending cap for each agent and decide what happens when it is reached.