Agentic Harness: What It Costs to Build One

I spent an afternoon looking for the bug in a hook that was supposed to read every prompt before it reached the model. There was no bug. It had never once been able to authenticate, for weeks, and every day it had reported the same nothing as though nothing were a result.

The credential was set. I had looked at it, in a list, showing as set.

Why an agent needs a harness ended with six things I want from any harness: real isolation, a visible difference between done and gave up, permissions built for nobody watching, credentials that reach the sandbox rather than the settings screen, a transcript that survives the run, and room to run more than one thing at once. This is the second post in that series, and it is about the half I skipped. Wanting the six is free. Here is what each one costs.

The examples come from a harness I have been building. It does not have a public name yet, because the name it was running under turns out to be Red Hat's container registry, so it has to change, and I would rather ship it under the right name than teach anyone the wrong one. Nothing below depends on it. Every one of the six is a question you can ask of whatever you are already running.

Isolation costs you a life cycle

The wall is the cheap part. Starting a container per task is an afternoon.

What costs is what the wall does to everything around it. Once the work happens inside a box you are not sitting in, the job cannot be the terminal any more. It has to outlive the terminal that declared it, which means the job is a record somewhere rather than a process on your laptop, and something has to write that record, start it, notice when it ended, and keep what it produced. The moment you can close the lid and walk away, you own a life cycle you did not own before.

Then there is the second wall, the one inside. A container decides where the work runs. It says nothing about what the worker is allowed to be. That is a separate thing to model, and the useful shape is a role: which model runs this job, what it is allowed to read, and which verbs it holds. Verbs are where it earns its keep. A role that ships work cannot declare work. A role that coordinates does not hold the editing verbs. An agent that can decide what to do, do it, and then declare it done has no boundary inside it, however good the box around it is.

Isolation is a role, not just a box

The box decides where the work runs. The role decides what the worker is.

The bill: a job record with a life cycle, and a verb list written down before the first run. The test is the one from part one. Name a job and say precisely what it cannot touch. If the answer is a paragraph rather than a list, that is not isolation.

Telling done from gave up costs an enumeration

A model's natural output is prose, so a harness that does nothing in particular gets prose. "I have updated the handler and it should now work" is not an outcome. It is an essay about one, and it hands the decision to whoever reads it, which is the job you were trying to give away.

The fix is unglamorous and it is not the same thing as asking for a better summary. Enumerate the outcomes a job may end in. Match the ending against that set exactly. Anything matching nothing in the set is a failure, not free text to be interpreted later. And gave up has to be one of the members, with a reason attached, because if the only legal way to finish is a success shape then a success shape is what gets written.

That gets you an honest report of the run. It still does not tell you the work exists. A green check is a claim, and the claim is only ever about the steps. I have watched a pipeline run every step it was given, report success, and ship nothing at all, because the identity it assumes could not create the thing it was asked to create. Nothing threw. Nothing arrived.

Two questions, not one

Ask the world whether the thing is there. Do not ask the run whether it finished.

So the cost is two pieces of work, not one: a closed set of endings the harness enforces, and a check at the end of each job that asks something other than the job whether the job happened.

Permissions for nobody watching cost a guess

When a person is at the keyboard, permission is a question asked at the exact moment it matters, by something that knows precisely what is about to happen. Take the person away and that question has no answer. It does not fail, which would be fine. It waits.

So the yes has to be written before the run starts, and that is the whole cost: you are moving the decision from the moment where you have all the information to a moment where you have none. Every unattended permission is a guess about what work you have not seen yet will need.

There are two ways to be wrong and they do not fail alike. Guess too broad and you have quietly handed back the isolation you paid for in the first section. Guess too narrow and the run stops, or worse, carries on and delivers nothing, which is the pipeline again: a grant made in advance, too small, and not one part of the system able to say so out loud.

Roles are the cheapest place I have found to put the guess, because a grant attached to a role is made once for a kind of work rather than once per run, and somebody can read the list and disagree with it. It is still a guess. It is just a reviewable one, and a narrow guess is only safe if the previous section is already built, so that refusal comes back as an outcome you can see rather than as an empty result.

Credentials that reach the sandbox cost a check inside the box

Back to the hook that did nothing for weeks. Claude Code strips the environment variable named CLAUDE_CODE_OAUTH_TOKEN out of every process it spawns. A variable holding the same value under any other name survives. So the credential genuinely existed on one side of the boundary and genuinely did not exist on the other, and the hook had no way to tell me, because telling me was the thing it needed the credential for.

Take the trap rather than the specific name, because the specific name will not be your problem.

A credential that shows as set is not a credential that arrived.

Everything between the settings screen and the process actually doing the work is somewhere it can be dropped: a spawn that filters names, an image that never passes it through, a sandbox that starts before the secret is written, a role that reads a different name than the code does.

Where a credential goes missing

The only check worth having runs inside the box, under the name the code will actually read.

The cost is more plumbing than it sounds, because that check needs the two sections above it to already exist. It needs somewhere to report to, and it needs "I could not authenticate" to be a legal outcome, or it is one more run that ends quietly.

A transcript that survives costs the wall you just built

There is a difference worth being pedantic about. What a run says about itself is testimony: the account of an interested party, produced by the same thing whose work is in question. What the run actually did, the commands, the outputs, the diffs, the refusals, is evidence. You want the evidence. When the two disagree, and they will, only one of them settles it.

The cost is that this pulls directly against the first section. Isolation says the box is disposable and should be thrown away the moment the task ends. Evidence says nothing readable inside that box may be lost. So you pay for the wall, and then you pay a second time to lift everything worth reading back over it before it goes, and you pay a third time to put it where a person will actually look rather than where a query could reach if somebody wrote the query.

Room to run more than one thing costs three parts you have not built yet

I gave this one line in part one and one line under sells it badly. Running many at once is not the first five made plural. It is three new things, and the third is the one everybody leaves out.

The first is admission. Something has to decide whether a job starts now, because capacity is finite: model quota, containers, machines, money. With no admission decision the answer is that everything starts at once, and everything starting at once behaves remarkably like nothing starting at all.

The second is a claim on the work. Two workers must not build the same thing, so a piece of work has to be claimed before it is started, the claim has to be visible to every other worker, and it has to be released when the work ends or expire on its own if the worker disappears. Get this wrong and the second worker's output is not merely wasted. It conflicts with the first, and now somebody is reconciling two honest attempts at one job.

The third is something watching for the system having stopped moving. Nothing crashes when work stops flowing. There is no error to catch, because every part in isolation is behaving legally: the queue is holding items, which is what a queue does, and no worker is running, which is what a worker does when it has nothing to do. Together those two facts are a stopped system.

What running many at once actually needs

Nothing throws an error when the queue stops draining. You have to go and ask.

That last one is the cheapest thing on this entire list and the easiest to skip. Work waiting and nothing running is one query away, it needs no new component, and it is always wrong when it comes back true. Write the query, run it on a schedule, treat the answer as an alarm.

Parallel work is also where the first five stop being nice and start carrying weight. With one run, watched, you can read the transcript yourself and tell done from gave up by looking at it. With several, unwatched, every one of those judgements has to have been built.

What I have not solved

Keeping the advance yes narrow while the work varies. Every version I have tried is either broad enough to give back the isolation it sits inside, or narrow enough that unattended runs stop on things a person would have waved through in a second. I do not have a good answer and I am not sure a general one exists, so at the moment the guess is per role and revised whenever it is wrong.

Six wants, six bills. If your harness skips one, my guess is the third part of the last one, because nothing ever complains about its absence.

Tell me which cost I have priced wrong. Happy coding.