Your AI agent is only as good as the harness around it

An agent can look brilliant in a demo. The question is neat, the documents are current, and every tool behaves. Then real users arrive with messy records, stale policies, odd wording, and half-finished actions, and the magic gets much less magical. That gap is where most agent projects live.

The source makes a simple case: the model is only one piece of the service. Around it sits the harness, the scaffolding that decides what data the agent sees, which actions it can attempt, and what happens when something is missing or broken. That means tool contracts, enforced permissions, inspectable traces, and tests built from the failures users are most likely to hit. A benchmark can tell you an answer sounds good. It can’t tell you whether the agent pulled the wrong account or kept going after a tool failed.

Tools need hard boundaries. The article’s billing example uses schemas, timeouts, error states, and an idempotency key, so a retry doesn’t accidentally apply the same change twice. It also splits failures into retryable and terminal states, because the model treats tool output like instructions. “APPROVAL_REQUIRED” is far more useful than a generic error code when the next step should be human review. And if the tool is defined through MCP, the plumbing may be handled, but the contract still belongs to the team.

Permissions are just as important, and not just for cleanliness. The piece argues that prompt injection makes access control a security boundary, not a nice-to-have. A support agent can explain a refund policy without issuing a refund, and the system should keep those apart. Credentials should be scoped to the tool’s job, user identity should be passed as a verified token, and refusals should be plain, not theatrical.

Context and traces turn the whole thing from guesswork into something debuggable. The harness decides what enters context, what memory persists, and what gets dropped before stale facts crowd out useful ones. Then traces record the request, the policy, the tool calls, the confirmation, the permission check, and the final response. When something breaks six months later, that record matters more than a pretty demo ever did.