What the harness does not do
A control you overestimate is a risk. Here is where this one stops.
It governs only what goes through it
An agent with a side door to a system is outside the boundary. The engine has to be the only write path, which takes least-privilege roles and controlled procedures.
It stops forbidden, not wrong
A confused or prompt-injected agent can propose something that passes every check and is still a bad idea. The harness limits blast radius. It does not supply judgment.
It only knows written rules
Unwritten practice, tacit judgment and rules nobody modeled are invisible to it.
Side effects can leave the boundary
When an action updates an ERP or reimburses someone, the downstream system's governance is its own.
It overlaps what you may own
If you run workflow, BPM or policy engines, parts of this overlap. Decide what each one owns.
Thousands of rules is unsolved
A handful of rules per action is easy to reason about. A few thousand across an enterprise is a governance problem of its own, and we have no tidy answer yet.
Stewardship is the hard part
Every rule needs a named owner who keeps it current. The technology is easier than the habit.
A product versus a pattern
The reference demo is a design pattern, not a production result. Early access is how we find out where it breaks.
Put a boundary around what your agents can do
We are onboarding a small group of early access teams. Tell us what you want to ground, automate or audit.
Request early access