Name every plane of a harness and the control that lives in each
and explain to a security team which mechanism enforces which boundary.
← The FDE reading roomHarness engineering
A field guide for forward deployed engineers / October 2026
Harness engineering
for forward deployed engineers
The model decides what. The harness decides whether.
A customer does not buy a model. They buy the loop that runs it, the instructions it reads, the context it sees, the tools it may call, the checks that decide done, the limits on what it can touch and the record of what it did. This guide builds that layer one subsystem at a time, with the 2026 evidence beside each decision and the ways each one fails.
Every answer, concept and course, every paper breakdown, all published video lessons, hands-on FDE Lab missions, Premium PDF guides and companion files, the full practice-test bank and work-sample downloads. Referral Premium excludes guide PDFs and their companion files.
Study alongside free video lessons.
Premium guide PDFs and companion files require active paid Premium or approved complimentary access. Referral Premium includes the rest of the site, but excludes these downloads.
136 pages · 37 chapters · PDF + tested companion + worksheets
Loop / policy / proof / budget
- pages in five parts
- 136
- original vector diagrams
- 32
- tests in the companion
- 69
- primary sources, checked October 2026
- 39
What is harness engineering?
A harness is everything around a frozen model that makes it an agent. The model is a function from tokens to tokens; it cannot read a file, run a test, remember yesterday or refuse to delete a database. Each of those is software, and together that software decides whether the same model is a demo or a system a customer will run unattended.
In 2026 the evidence stopped being anecdotal. With the weights held fixed, published harness changes moved public benchmarks by 3 to 14 points; the same model produced a broken application alone and a working one inside a harness; and the year's worst agent incidents were harness failures: an over-scoped token in a file, a backup inside the blast radius of the thing it protected, a destructive endpoint with no gate. This guide covers both halves, the gains and the failures, with the primary source beside each claim.
It is organized around seven planes: control, instruction, context and memory, capability, policy, execution and assurance. Every chapter names the mechanism, the evidence and the way it fails, and ends with links to the FDEInterviews concepts, questions, lessons and paper breakdowns that drill it.
Three complete pages, free to read
The architecture, the honest number, the printed session.
Read three pages from the PDF at full size: the seven-plane reference architecture, the measured limits of classifier permissions, and one unattended session as the companion prints it.
Page 15 / Sample
Seven planes around a frozen model
See the one architecture that reconciles the public harness taxonomies, and the two planes most of them leave out.
Open the page at full size ↗
Page 64 / Sample
The honest number behind classifier permissions
Read the measured false-positive and miss rates of a deployed permission classifier, and where deny rules and people still belong.
Open the page at full size ↗
Page 112 / Sample
One unattended session, printed by the companion
Follow a scripted run where an injected force push is denied, a premature "done" fails verification and the feature list refuses a claim.
Open the page at full size ↗
Learning outcomes
What you can do when you finish.
Read any harness claim with five questions
fixed model, sample size, tuned on the test set, documented infrastructure, who judged.
Write the instruction map, the verification contract and the threat model
before the first unattended run, in the order that minimizes retrofit cost.
Set budgets from the cost of passing runs
and route every failure to a class the runbook can act on.
Report reliability, completion and paired uncertainty
instead of a single number from a single run.
Decide where self-improving harnesses belong
offline, egress blocked, edits through review, invariant and domain layers apart.
37 chapters in five parts
One subsystem at a time, with the evidence beside it.
The harness
What a harness is, same-model evidence and its limits, one reference architecture that reconciles the public taxonomies (with the everything-is-a-plugin design weighed), and the adopt, extend or build decision.
- 01
What a harness is
p. 7 - 02
Same model, different harness
p. 11 - 03
The reference architecture
p. 15 - 04
Adopt, extend, or build
p. 20
Anatomy
The loop and its controls, instructions as a map, context assembly and the cache, memory and the system of record, tools, connectors and the July 2026 protocol, skills, retrieval and grounding, sub-agents, verification and the session lifecycle.
- 05
The agent loop
p. 23 - 06
Instructions: a map, not a manual
p. 28 - 07
Context assembly and the cache
p. 32 - 08
Memory, state and the system of record
p. 36 - 09
Tools
p. 39 - 10
Connectors and the protocol
p. 42 - 11
Skills
p. 45 - 12
Retrieval, the web and grounding
p. 48 - 13
Sub-agents and multi-agent patterns
p. 50 - 14
Verification and the definition of done
p. 53 - 15
The session lifecycle
p. 57
Securing and operating
A threat model from the 2026 incident record, permission models with their measured limits, credentials and the blast radius, sandboxes and egress, the agent supply chain, audit, and a fourteen-row checklist to prepare for a security review.
- 16
The threat model
p. 60 - 17
Permission models
p. 63 - 18
Credentials and the blast radius
p. 65 - 19
Sandboxing and egress
p. 68 - 20
The agent supply chain
p. 71 - 21
Audit and observability
p. 74 - 22
A checklist for the security review
p. 77
Cost, evaluation and improvement
Where tokens go, nine levers ranked by evidence, budgets and failure classes, the customer eval with pass^k, the noise procedure, self-improving harnesses and operations.
- 23
Where the tokens go
p. 80 - 24
Cost levers, ranked by evidence
p. 83 - 25
Budgets and failure classes
p. 87 - 26
The customer eval
p. 90 - 27
Noise, and numbers you can compare
p. 92 - 28
Self-improving harnesses
p. 94 - 29
Operating the harness
p. 97
Applied
Domain adaptation, anti-patterns, the October 2026 landscape, two worked engagements printed by the companion, the first week, the companion and the twelve invariants.
- 30
Adapting a harness to a domain
p. 101 - 31
Anti-patterns
p. 104 - 32
The landscape, October 2026
p. 107 - 33
Worked engagement: a coding harness at Marlow Freight
p. 110 - 34
Worked engagement: a reconciliation harness at Caldera Freight
p. 114 - 35
The first week on a new engagement
p. 118 - 36
The companion
p. 121 - 37
The invariants and a working vocabulary
p. 124
The chapters close with twelve release-blocking invariants, a working vocabulary and 39 primary references, each attached to the bounded claim it supports.
Two engagements, printed by the code.
The same companion loop runs a coding harness and a finance-desk harness with different policies, tools and oracles. Every number in both chapters is computed by the shipped scenarios from a scripted model, so the runs are reproducible; the organizations are fictional and say so.
Fictional logistics software team / unattended overnight changes
A coding harness at Marlow Freight
An injected force push is denied before it runs, a premature done fails the verification ladder, the feature list refuses a claim without evidence, and a separate synthetic evaluation shows how to compare matched trials without hiding missing grades.
Fictional brokerage finance desk / adjustments that need a person
A reconciliation harness at Caldera Freight
A remittance taken from a supplier note with a hidden character is denied outright, one approved adjustment posts and an unapproved one is refused, an oracle checks the actual ledger and receipt, and a seven-record audit chain verifies and fails on a tampered copy.
Included / tested companion and worksheets
Break a control. Watch the test go red.
Eleven small modules implement the decisions the guide describes: the loop with its budget, policy, loop detection, truncation and verification gate; a deny-first policy; context assembly that counts separators and elision notices; controller-owned feature completion; the evidence ladder with exact verdict parsing; the session start and end; a pinned registry with a hidden-character scan; an in-memory audit chain with an anchor check; DNS-aware egress decisions; and an eval runner with matched trials, missingness and task-level uncertainty.
It runs on Python 3.10 or later, with Git for session tests and no packages, keys or network. Six exercises explain what to change and what evidence to expect. Production isolation, identity, durable storage and network enforcement need separate adapters. The shipped archive passed 69 tests, and its verification reintroduced 36 design mistakes, each caught by a test.
9 worksheets for the engagement.
- Instruction map and verification contract
- Threat model and cost budget
- Eval plan and domain adaptation
- The first week
- Security checklist with inventory, and the runbook
Worksheets organize the decisions. They do not replace the customer's policies, contracts or legal advice.
Practice each subsystem.
The PDF links to the concepts, questions, course lessons and paper breakdowns that drill each part of the harness. Each resource keeps its displayed access level.
Chapters 1, 3 and 5
Define the boundary and the loop
Chapters 6 to 8
Instructions, context and memory
Chapter 14
Verify before you trust
Chapters 16 to 19
Permissions, credentials and sandboxes
Chapters 26 to 28
Measure, compare and improve
Prefer to build first? The Harness Engineering course is 44 lessons and ten projects on the same subject; the guide is its reference shelf.
Six terms the guide uses precisely
- Harness
- Everything around a frozen model that makes it an agent; distinct from an evaluation harness, which runs trials and grades them.
- Deny rule
- A permission rule evaluated first and never overridable by an allow, a prompt or the model.
- Evidence ladder
- Verification from cheapest to most real; done returns only from the top.
- pass^k
- The share of tasks solved on all k trials; the reliability number for unattended work.
- Paired comparison
- A comparison of matched task and seed outcomes, with missing grades disclosed and uncertainty calculated across tasks.
- Overlay
- The customer-owned layer: instruction map, skills, scripts, oracles, policy, eval.
Before you download
What is harness engineering?
Harness engineering is the design of everything around a frozen language model that turns it into an agent you can run: the loop, the instructions it reads, the context it sees on each turn, the state it keeps between sessions, the tools and connectors it may call, the checks that decide whether work is done, the permissions, credentials and sandboxes that bound what it can touch, and the audit record of what it did. The model decides what to do; the harness decides whether, when, where and how, and whether the result counts.
How does the harness affect results?
Published same-model comparisons show that harness changes can materially affect task success and cost. Their gains depend on the workload, compute budget and evaluation method; they do not establish that the harness always matters more than the model. The guide reproduces those comparisons with their conditions, and shows that infrastructure configuration alone moved one benchmark by six points, so it also teaches how to measure your own harness changes honestly.
Who is this guide for?
Forward deployed engineers and platform engineers who adopt, extend or build agent harnesses inside a customer's environment, and candidates preparing for agent and system design rounds. It assumes you can write production software and have used a model API inside an agent loop; it does not assume you have run one unattended for six hours or answered a security team about it.
Which runtimes does it cover?
The patterns are runtime-neutral, and the October 2026 landscape chapter records what Claude Code and the Agent SDK, Codex CLI, Antigravity CLI, Cursor, Deep Agents, DeepSeek Harness, Google's Agent Sandbox on GKE and the Harness² research system had published, each statement tied to the owner's own page. The reference architecture chapter weighs DeepSeek Harness's everything-is-a-plugin design, what it buys and what it costs.
What does the download include?
The 136-page PDF with 32 original vector diagrams, two fictional worked engagements, a fourteen-row security checklist and a first-week plan, plus a separate companion: a standard-library Python implementation of the loop, budgets, a deny-first policy, context assembly, the feature list, the evidence ladder, the session lifecycle, a pinned registry with a hidden-character scan, an in-memory audit chain, per-path egress decisions and an eval runner with reliability metrics and paired comparisons, with 69 tests and 9 worksheets.
How was it checked?
The guide checks dated claims against source publications in October 2026 and labels secondary incident reporting. It cites 39 references, each with a phrase the link check must find on the page. The two worked engagements are printed by the shipped code. A verification script extracts the exact companion archive, runs its tests and both scenarios, and reintroduces 36 design mistakes the guide warns about, requiring a test to catch each. The PDF passes layout, link, figure and fingerprint checks. AI assisted research, writing, code and the cover illustration; this edition is prepared for publisher review and automated checks do not imply independent human approval.
Is the companion production software?
No. It is teaching code, small enough to read in an afternoon, with tests that state what each control must refuse. A production harness needs your customer's identity provider, sandbox, secret store and observability stack around the same decisions. Port the tests first when you build the production version.
How does it relate to the Harness Engineering course?
The course is practice: 44 lessons and ten projects that build a coding harness and a procurement harness. The guide is the reference and the evidence: what each subsystem is, what the public record shows about it, where it fails, and how to defend it in a review. Chapters link to the lessons that drill them, and both are included with Premium.
Do I need Premium or a separate purchase?
The full PDF and companion are included with active paid Premium or approved complimentary guide access. No separate purchase is needed. Three complete sample pages are public. Referral-only online Premium does not include guide downloads.