What an agent harness does in production.

When a model starts calling tools, the hard question is not which chat skin to buy. It is what sits around the model so proposals stay proposals until a human releases them.

An agent harness is that layer: tools, memory, permissions, eval, and release gates assembled so the model can work without becoming the operator. This piece maps what a harness does in production — the same pattern agents on Spectacle use when work must wait for approval.

Five parts around the model

Name five controls before any tool write leaves the trust zone:

1. Tools — Which actions may the agent call? Which objects do they touch (file, record, ticket, schedule, message)? Which endpoints and secrets sit behind each call? A tool list without an owner is theatre.
2. Memory — What context is assembled each turn — and what is compacted, dropped, or never loaded? Memory is not “the model remembers.” It is which objects and logs the harness puts in front of the model, and which it withholds.
3. Permissions — Who may invoke which tool on which object class? Read vs propose vs act. Firm-wide infrastructure vs mandate- or matter-scoped paths. Permissions map to objects from the operation and, for sensitive paths, to a case graph (sensitive data needs a case graph).
4. Eval — Multi-turn checks before production approval: did the agent stay in the allowed tool set, cite the right objects, stop when uncertain, and refuse irreversible steps? Eval is a gate, not a dashboard wallpaper.
5. Release gates — A person with operational responsibility releases the proposal (or refuses). The model may draft. The name under the action stays human. See without approval the agent sleeps.

That is what an agent harness does in production. Chat alone is not the harness.

Once, in body: harness, scaffold, runtime

SERP language often collapses three words into one. Say the distinction once. A prompt scaffold is schemas and persona text. A runtime is the sandbox, credentials, and network the process runs in. A harness is the control loop — assemble context, dispatch tools, observe, compact memory, error, verify, and stop safely — with eval and release gates before production approval. Do not turn the distinction into a slogan title. Counsel and ops still own which layer you buy or build.

Named eval platforms and open-source harness repos show up as SERP clutter. Note the type. Do not endorse a brand as the answer.

What the harness must touch in the operation

Controls only bite if they map to objects you already name:

• Which objects may leave which trust zone (objects from the operation; sensitive data needs a case graph).
• Whether a path is firm-wide infrastructure or scoped work that needs a tighter approval trail.
• Logging: who released which proposal into which tool path, and when.
• Stop conditions: when the agent must sleep instead of guessing.

Sovereign hosting such as STACKIT can be a residency option for inference. Hosting is not the operation — models on STACKIT are not the operation. Cite only; do not republish that cousin. Residency does not finish the harness.

Approval still holds the switch

Agents on Spectacle may propose language and next steps grounded in objects the stack already holds. Without approval the agent sleeps. Sealed systems of record are not written back. Arithmetic stays in code. The model only writes language. We do not invent hours, ROI, euros, or accuracy bands.

What we are not selling

Not a named competitor agent-harness SaaS. Not an eval-platform pitch. Not a remake of live STACKIT or case-graph cousins. Not “AI for hospitality” or restaurant software. Not a deep-tech kernel pitch. Not silent write-back. Not a claim that any cloud or on-prem stack is “production-safe” by brand.

One core, every kind of business — one core, every operating type. Six sector bands equal. White-collar and ops paths use the same pattern — objects, zones, approval — not a sector SKU.

FAQ

What is an agent harness?
The software around the model that assembles tools, memory, permissions, eval, and release gates so proposals wait for human approval.

Is a prompt scaffold the same thing?
No. Say it once: scaffold is prompts and schemas; runtime is sandbox and credentials; harness is the control loop with eval and release gates. Ops owns the stack choice.

Do agents act without approval?
No. They propose. You release. Without approval the agent sleeps.

Can we name STACKIT?
Yes as infrastructure vocabulary. No as a claim that hosting alone finishes the harness.

Do you invent accuracy or ROI figures?
No. Arithmetic is code. We do not invent hours, euros, or accuracy bands.

Is this only for one sector?
No. Six bands equal. The harness pattern — tools, memory, permissions, eval, release — repeats wherever agents sit near operational objects.

Where should I start?
Spectacle. The Insights series is how we write about the operation.

CTA

If agents sit near operational objects and the harness is still unnamed — tools, memory, permissions, eval, release gates — request an initial analysis. Twenty minutes is enough to see whether proposals wait for human approval before any tool write leaves. If the data cannot answer, we say so.