What surrounds
the model.

Agent harnesses, in plain terms. One ordinary task, followed through the five parts that let a model do work.

Last updated: October 2026

Follow the task Five questions to ask

The short
version.

An AI model does not do work by itself. It reads text and writes text. The software around it is what opens your accounting system, drafts the email, checks the amount and waits for your approval.

That software is called a harness. The Claude and ChatGPT apps you may already use are harnesses, and so are Claude Code and Codex, two tools built for programmers. Below, we follow one ordinary task through a harness, part by part.

The task
we follow.

Every month, someone goes through the unpaid invoices and writes to the customers who are late. It takes judgement: who gets a gentle note, who gets a firm one, and who is in a dispute and gets nothing.

We hand that task to an AI system and watch what each part of the harness does with it. The task is an illustration, chosen because many businesses have it. It is not a client case, and no product named on this page comes set up for it.

A model
on its own.

A model has general knowledge. It has none about your business. It was trained to continue text: given the start of a sentence, it produces a likely next word, then the one after. Ask it to follow up on your overdue invoices and it writes a polite reminder. Then it stops, because four things are missing.

  1. 01

    It cannot act.

    It can tell you what to send, and then you send it.

  2. 02

    It does not know your business.

    Not your customers, your payment terms or what you asked yesterday.

  3. 03

    It cannot see your records.

    It has only what someone puts in front of it.

  4. 04

    It cannot check.

    It can write an amount without ever comparing it with the invoice.

What a
harness is.

A harness is the software around the model that gives it tools and decides what it sees. Anthropic’s documentation describes Claude Code as “the layer around the model that provides the tools and manages the context the model sees”, and calls that layer an agentic harness. Agentic means the system takes actions and does not only answer. Context means everything the model has in front of it at a given moment.

Claude Code is Anthropic’s coding agent and Codex is OpenAI’s. We name them because their documentation is public and specific. By the same definition the Claude and ChatGPT apps are harnesses too, which is our reading and not the vendors’ wording.

This page splits what a harness does into five parts. It is one way to cut it, not an official list: Anthropic’s definition names only two, tools and context.

A model and the five parts described on this page Harness for example Claude Code, Codex Model reads text, writes text Tools how it acts Permissions what it may not do Context what it knows about the job Memory what carries over Verification how it checks its work

Five parts,
one task.

Each part in the same order: what it is, what it does in the invoice task, its real name in Claude Code or Codex, and its limit.

Tools

A tool is one action the harness can carry out for the model. The model writes a request in a fixed format, the harness performs the real action, and the result comes back as text.

In the invoice task
Three tools: read the list of unpaid invoices from the accounting system, read the last emails exchanged with a customer, and create a draft email.
The real names
Claude Code’s documentation puts it in one sentence: without tools, Claude can only respond with text. To reach a company’s own systems, many harnesses use MCP, the Model Context Protocol, an open-source standard for connecting AI applications to external systems.
The limit
Each tool is a door into one of your systems. Connecting it decides what the AI system can read and what it can change, so that list deserves the review you give user accounts.

Permissions and the sandbox

Permissions set what the system may do without asking a person. A sandbox is a fenced area that limits what a mistake can reach.

In the invoice task
The system may read invoices and write drafts. It may not send. A person reads each draft and sends it, and that is the first line we would draw.
The real names
Claude Code has permission modes. In Manual mode it asks before most actions that edit files, run commands or reach the network. In auto mode a second model, called the classifier, reviews most actions instead of you and blocks the risky ones; as of October 2026 that is the starting mode in its command-line version. Codex has two comparable settings, a sandbox mode and an approval policy.
The limit
Claude Code’s sandbox is off by default and covers only the commands it runs on the computer; connections made through MCP run outside it. In the invoice task, accounting and email go through such connections, so the no-send rule does the work. A file edit can be reversed; a sent email cannot.

Context

Context is what the model is told about the job before anyone types a request. The harness adds it at the start of each session, a session being one working conversation from start to finish.

In the invoice task
Your payment terms, the tone you use with customers, the customers who never get an automatic reminder, and where the invoices are kept.
The real names
A file of written instructions. Claude Code reads one named CLAUDE.md at the start of every session. Codex reads one named AGENTS.md before doing any work.
The limit
The file guides the model and does not bind it. Anthropic’s documentation says Claude treats these instructions as context, not enforced configuration. Anything that must never happen belongs in permissions.

Memory

Memory covers two different problems: a conversation that gets too long, and a conversation that ends.

In the invoice task
A long list of invoices fills the conversation, so the harness summarises what came before and carries on. Next month the work starts from a blank conversation, unless something was written down, such as a note that one customer always pays in the second week.
The real names
Summarising a long conversation is called compaction: Claude Code clears the older results first, then summarises if needed. Notes kept between sessions are called auto memory: notes Claude writes itself from your corrections and preferences.
The limit
Compaction loses detail, and instructions given early in a conversation may be lost, which is why lasting rules go in the instruction file. Auto memory has a ceiling: at most the first 200 lines of its main note load when a session starts.

Verification

Verification means the work is checked against something other than the model’s own judgement. A model can write that an amount is correct without looking it up.

In the invoice task
Before a draft reaches a person, a fixed check, not the model, compares the amount and the due date in the email with the accounting record. A mismatch holds the draft back.
The real names
Claude Code describes a task as three phases: gather context, take action, verify results; not every task needs all three. A harness can also force a check with hooks, commands it runs automatically before or after an action.
The limit
A check catches only what it was written to catch. An email with the right amount and the wrong tone passes.

The
loop.

The five parts run inside one loop: gather context, act, check, and go around again until the task is done.

For each invoice the system reads the record, drafts the email and compares the amount, then moves to the next one. When the list is finished it reports back, and the drafts wait for a person. A person can step in at any time: in Claude Code you can interrupt at any point to steer the work.

The harness runs the model in a loop until the task is done Your request Gather context instruction file, memory Take action tools, if permitted Verify results automatic checks Report back not done yet: go around again

Five questions
before you choose.

When you evaluate an AI system, the name of the model is only part of the answer. The rest is in what surrounds it, and each part gives you one question to ask.

Part The question to ask What a good answer looks like
Tools Which of our systems can it read, and which can it change? A list, system by system, that separates reading from changing.
Permissions and the sandbox What can it do without asking, and which of those actions cannot be undone? It prepares and a person approves. Anything that cannot be undone always waits.
Context What does it know about our business before anyone types, and who keeps that current? A written set of rules that a named person on your side owns and updates.
Memory What does it keep from one session to the next, and where is that stored? Notes you can read and delete, kept in a place the vendor can name.
Verification What checks its work before a person sees it? A check against your own records, with a statement of what is not checked.

When you want a hand

If you are choosing a system for one of your workflows, or one needs a harness built around it, start with a conversation.

Discuss your challenge

Sources

Product facts were read in each vendor’s own documentation on October 7, 2026. The pages are in English. The invoice task is our illustration and comes from no source.