> ## Content Index > Fetch the complete content index at: https://www.aigl.blog/llms.txt > Use this file to discover other available public pages before exploring further. # Agentic AI Harnesses – The layer above the model - URL: https://www.aigl.blog/agentic-ai-harnesses-the-layer-above-the-model/ - Published: 2026-09-18T14:14:43.000Z - Updated: 2026-09-18T14:14:43.000Z - Description: This guide explains the agentic AI harness: the software layer connecting an LLM to data, tools, memory and workflows. It outlines harness components, security risks, controls and executive governance questions. - Author: Jakub Szarmach - Tags: Guidance, Agentic AI, AI Security, Risk Management, Technical Controls, AI Governance, #aigl-library ## ⚡ Quick Summary Published by Australian Signals Directorate, this guide explains the agentic AI harness: the software layer that enables a large language model (LLM) to interact with data, tools and systems in order to perform agentic tasks. It is aimed at organisations adopting or considering agentic AI, particularly executive decision-makers, chief information security officers and IT leaders. Its purpose is to show how harness design affects the security, governance, reliability and operational risks of agentic AI systems. The guide distinguishes the LLM from the harness, which comprises the surrounding components that supply context, memory, tools and service access; enforce action and execution privileges; operate the control loop; and record evaluation metrics. It argues that the harness, rather than the replaceable model, is likely to be the more enduring organisational capability and the primary configuration surface for risk management. The document sets out ten harness components, five categories of agentic AI security risk, good-practice controls, and questions for directors and senior executives. Its central recommendation is to introduce agentic capability in phases, begin with low-risk use cases, limit access and permissions, maintain human accountability, and expand deployment only as controls mature. ## 🧩 What’s Covered The document progresses from the purpose and definition of a harness to its operational controls and executive oversight. - **Purpose, audience and key takeaways:** Explains that the harness is the component organisations can most directly govern, secure and control. It identifies executives, CISOs and IT leaders as the intended audience, and positions the harness and its ecosystem as the primary focus for security and risk management. - **Definition and distinction from an LLM:** Defines a harness as all agentic-system components other than the LLM, including its connections to external tools, data sources, memory and planning workflows. A comparison describes the LLM as stateless and producing tokens, while the harness is stateful, executes tools and APIs, supplies controls, and supports validation, retries and error recovery. - **Consequences for design and investigation:** States that one harness can operate with multiple LLMs and may outlast model upgrades. It also explains that unexpected agent behaviour can arise from model–harness interaction, such as inappropriate tool selection, lost context or an unsafe proposed action, requiring investigation of configuration as well as model decisions. - **Harness components:** Lists the user interface, prompt and policy layer, context manager, model interface, tool registry, permission system, execution environment, connector layer, memory and session store, audit and observability, and update and supply-chain path. Each is linked to a control or risk, such as exposure of sensitive context, approval of sensitive actions, or supply-chain risk. - **Security risks and mitigations:** Describes how connectors, external tools, data sources and memory expand the attack surface and introduce trust relationships. It presents privilege, design and configuration, behavioural, structural and accountability risks, and treats a multi-agent system as a single agent for security purposes. - **Good practice:** Recommends hardened organisation-controlled environments, least privilege, output and parameter validation, human approval of high-impact actions, protected logs, model provenance assessment, focused context, cost monitoring, bounded sub-agents and a persistent mandatory rules file. - **Executive governance and conclusion:** Provides assurance questions about business outcomes, agent access, approvals, mitigation of prompt injection and data poisoning, auditability, risk tolerances and worst-case compromise. It closes by calling for mature controls and human oversight before broader deployment. ## 💡 Why it matters? The guide directs governance attention to the software layer where an organisation determines what an agent can see, which systems and tools it can use, and which actions it may execute. This is practically important because the document says prompt injection has no fully reliable technical mitigation and must therefore be constrained through access and action controls in the harness and connected infrastructure. For security and assurance teams, the recommended logging of prompts, responses, tool invocations, approvals, actions and configuration changes provides a basis for monitoring, incident response, investigation and accountability. The executive questions also translate these technical controls into decisions about purpose, acceptable risk and human approval. ## ❓ What’s Missing This is a concise, general guide rather than a detailed implementation manual. It identifies components and recommended practices, but does not provide reference architectures, configuration examples, control test procedures, or technical specifications for a particular harness product. Its security-risk taxonomy and lifecycle controls are attributed to ASD's separate *Careful adoption of agentic AI services* publication, which the guide recommends rather than reproducing in full. The document does not set out legal obligations or jurisdiction-specific compliance requirements; its disclaimer states that the material is general in nature and should not be regarded as legal advice. It also does not provide a scoring method for deciding when controls have matured sufficiently for broader deployment. ## 👥 Best For Executive decision-makers, CISOs and IT leaders assessing whether to introduce agentic AI will find a focused set of assurance questions and deployment principles. Security architects and teams configuring agent workflows can use the component list and good-practice measures to review permissions, connectors, execution environments, logging, human approvals and containment of sub-agent activity. ## 📄 Source Details *Agentic AI Harnesses – The layer above the model* is a 12-page English guide published by the Australian Signals Directorate. The cover states “First published: September 2026”; no individual authors or edition number are named. The complete PDF was supplied for analysis. The document is copyright © Commonwealth of Australia 2026 and states that, except where otherwise stated, its material is provided under a Creative Commons Attribution 4.0 International licence.