Free mini-course · Layer 3 of 5

Harness Engineering: build the floor the agent stands on

The third layer. The harness is everything around the model: tools, state, permissions, memory, sandboxes, retries, observability. A model can only be as reliable as the environment it runs in. When an agent lacks a capability, that is never a prompt problem — it is a harness problem. Eight lessons — including the three-layer diagnostic: which layer owns the failure.

promptscontextharnessloopsgraphs
LESSON 01

Tools are contracts, not conveniences

A tool is a structured-output schema the model fills in: name, parameters, and a description that tells the model exactly when to use it. Overlapping tools create wrong choices; vague parameter names create garbage arguments. Write tool descriptions with the same care as prompts — they are prompts, injected on every turn.

Do this now: Take one tool (or imagine one: search, calculator, file-reader). Write its one-paragraph description including when NOT to use it. Ambiguity here is where agents go wrong.
LESSON 02

Own your control flow and state

The 12-factor rule: the framework shouldn't decide what happens next — your code should. Keep execution state (what step we're on, what's done) unified with business state (the actual data), so a crash or pause loses nothing. An agent you can launch, pause, and resume with simple APIs is an agent you can operate; one that lives inside a framework's hidden loop is one you can only restart.

Do this now: Sketch your agent's state as a single JSON object: inputs, work done, pending steps. If you can't write it down, the framework owns it — not you.
LESSON 03

Errors are context, not exceptions

When a tool fails, the worst harness swallows the error; the best compacts it into the window so the model can react — retry, work around, or ask for help. Same for limits: timeouts, retry budgets, and spend caps belong in the harness, not in hope. An agent that never sees its own failures repeats them.

Do this now: Add one rule to your setup: every tool failure returns a one-line structured error (what failed, why, what's allowed next). Watch recovery behavior change.
LESSON 04

Permissions, sandboxes, and the blast radius

Decide what the agent can do before deciding what it should do. Read-only by default; writes gated; irreversible actions (send, delete, pay) behind human approval. Sandboxes make ambition safe: an agent with a scratch directory and no production keys can try things an unrestricted agent must never attempt. Small blast radius is what lets you grant autonomy.

Do this now: List your agent's five most dangerous possible actions. For each, write where the gate lives: blocked, sandboxed, or human-approved.
LESSON 05

Observability: if you can’t see it, you can’t ship it

Every run should leave a trace: which tools fired, with what arguments, costing what, taking how long. That's how you debug the layer correctly — missing capability is harness, unreliable completion is loop, wrong order is graph. Without traces, every failure looks like “the model was dumb,” and you fix the wrong layer.

Do this now: Log one day of your agent's tool calls (even manually). Rank failures by layer: capability, completion, or ordering. The histogram tells you what to build next.
LESSON 06

The nesting: environment → feedback → flow

Harness, loop, and graph are not competing approaches — they nest. The graph runs inside the harness; the loops live inside the graph’s nodes; and the harness supplies the state, tools, and evaluators those loops consume. One phrase holds the whole stack: the harness is the environment, loops are the feedback, the graph is the flow. And one test finds your harness instantly: remove the model from your architecture diagram — everything left (tools, data access, state store, sandbox, evaluators, retry policy, UI) is the harness. Two teams on the same model get very different outcomes because the working conditions differ, not the intelligence.

Do this now: Draw your system with the model as a black box. Label every remaining piece E (environment), F (feedback cycle), or W (flow control). Anything you can’t label is architecture debt.
LESSON 07

Diagnose the failure, then pick the layer

Each layer is a different lever to pull when the system fails. Fix the layer that owns the failure — a model cannot reliably compensate for stale state, ambiguous tool schemas, broken APIs, or missing exit conditions.

SymptomLayerLikely fix
Can’t access the right data or tool safelyHarnessTool contract, permissions, sandbox
Forgets progress across sessionsHarnessDurable state, checkpoints, progress artifacts
First attempt close but not reliableLoopExternal grader, deterministic tests, bounded retry
Keeps working after success, or stops before proofLoopEvidence-based stop rules, budget limits
Specialists must run in a controlled orderGraphExplicit nodes, edges, routing, joins
Failures hard to locate in a multi-step processGraph + harnessTraces aligned to nodes and transitions
Workflow changes too often for a fixed diagramSimpler harnessKeep control model-driven; delay the graph

The most useful row is the last one: when the model must invent the plan dynamically, forcing every path into a diagram makes the system more brittle, not less. A graph can freeze assumptions too early — formalize the stable paths you observe, not the process you imagine.

Do this now: Take your last three agent failures and find their row. If you fixed a different layer than the table names, that is why the fix didn’t hold.
LESSON 08

The five expensive mistakes

The failure patterns behind most weak agent architectures: building the graph before understanding the work (start with traces from a simpler harness, then formalize the stable paths); letting the same model write and grade without safeguards (shared blind spots — prefer deterministic checks, separate reviewer context, human gates for high-impact actions); “keep trying” as a loop specification (an unbounded retry loop is a cost leak — every loop needs a measurable objective, fresh evidence, a retry cap, and a named escalation path); treating the harness as a dumping ground (more tools raise selection errors, noisy context raises confusion, broad permissions raise risk); and blaming the model for orchestration failures.

Do this now: Run the production checklist against your agent. Harness: tools narrow and observable, state durable, least privilege, can you pause/inspect/resume? Loop: what evidence proves success, what feedback returns on failure, how many retries, what happens at budget exhaustion? Graph: which paths are deterministic, what runs in parallel, where are the human gates? Evaluation: can you replay traces and attribute improvement to a change? Operations: are cost, latency, failure rate, and intervention rate monitored?
Go deeper — the sources this course is built on:
12-Factor Agents (own your prompts, context, control flow; small focused agents; stateless reducer) · Anthropic: Building effective agents · @beamnxw’s “Agent Harness Engineering vs. Loop Engineering vs. Graph Engineering” — lessons 06–08 synthesize its nesting model (environment → feedback → flow), the failure-diagnosis table, and the five expensive mistakes