An AI harness is everything wrapped around a model that lets it act in the real world. Four parts do that work: the tools it can call, the permissions it runs under, the environment it runs in, and the loop that keeps it going until a job is finished.
Claude Code and OpenAI’s Codex are the two you have probably heard of, and Cursor sits in the same category. All three are coding agent harnesses. You will also hear the same idea called agent scaffolding, or hear it mixed up with an agent framework, which is the plumbing a developer installs to build one.
What can an AI harness do that a model cannot?
On its own, a model returns text. Put that model in a harness and it opens a browser, runs code in a terminal, executes Python, edits a file, and works out which file to edit in the first place.
| Model on its own | Model in a harness | |
|---|---|---|
| What comes out | Text | Text, plus actions: a browser opened, code run, a file edited |
| Finding a file | Reasons about where it might be | Runs a keyword search across every file in the project |
| Limits | Whatever you thought to type in the prompt | Permissions checked before the action runs |
| When it goes wrong | You find out later | The harness reverts and puts things back |
File-finding is the clearest example. Early coding agents could not reliably traverse a codebase to work out which file they were supposed to edit, so Claude Code and Codex shipped grepping: a small piece of code that searches every file for a keyword. Editing the notifications feature means pulling up the files with the word “notification” in them. No extra intelligence involved, just a search someone bothered to build in.
Nothing about that is specific to code. Ask an agent which of your 900 lease files expires in March and the useful answer comes from a tool that reads filenames and dates, not from a cleverer model. Hand it a generic web search instead and it starts reading leases one at a time until the context window fills up.
Why is it called a harness?
The word comes from climbing. A strong climber moves fast, and the harness is what makes moving fast survivable: it keeps the climber under control, and when they fall it catches them and puts them back where they were. When a model edits the wrong file, the harness reverts the change, which is the only reason you can let a coding agent loose on work you care about.
Most of that control shows up as permissions. The standard split in software is production against staging. Production holds your live data; staging is a mock-up of what that data looks like. The harness decides which one the model may touch, and the second it sees an attempt on production it stops. That rule sits outside the model’s judgement, which is why Claude Code and Codex can prevent you from doing things Anthropic and OpenAI would rather you did not do.
An agent that reads your dispatch board and drafts the invoice sits at one permission level. One that emails it to the customer sits at another, and the harness is where you draw the line: under $2,000 it sends on its own, over $2,000 it stops and asks. Then decide what happens to the $2,400 invoice that lands in that queue at 6pm on a Friday, because the harness will hold it until Monday morning unless you named a second person who can approve.
Not every harness is a coding tool. A research harness aims the same model at documentation and specific citations, and it can require a citation on every claim before the work counts as finished. Switch that on and the model loses the ability to hand you a confident paragraph it could not source. It hands you a gap instead, which is more useful and reads worse.
What separates a good harness from a bad one
Three things, and none of them is the model:
- Tool reliability. A harness with too few tools cannot finish the job, one with too many picks the wrong one, and one that rents every tool from a third party breaks whenever any of them changes. Claude Code and Codex build most of theirs in-house.
- Permission calibration. Too vague and the agent touches things you never sanctioned. Too tight and it stops halfway through work you wanted done.
- Observability. Whether anyone can see how the model performed during a run. Anthropic gets a lot of that back from Claude Code sessions: what the agent was thinking, how it used its tools. That feed is what improves the next version of the harness.
Harness vs orchestrator
The harness is where an agent acts. The orchestrator is what decides the plan it acts on: breaking a task into steps and picking which model runs each one. The distinction earns its keep when a run fails, because a bad plan is the orchestrator’s problem and a blocked action is the harness’s. The orchestrator is the next lesson.
