Robots Atlas>ROBOTS ATLAS
Infrastructure

Agent Harness

2022ActivePublished: 5 May 2026Updated: 5 May 2026Published
Key innovation
Isolating everything that exists outside the language model but is required for agent operation — the control loop, tool schemas, sandbox, memory, policies, attribution, and communication protocols — into a distinct engineering layer that can be swapped independently of the base model.
Category
Infrastructure
Abstraction level
Pattern
Operation level
OrchestrationToolingApplication
Use cases
Per-agent harness in Claude Code, Cursor, Devin — loop, tools, sandbox, project memoryAgentic frameworks: LangGraph, CrewAI, AutoGen, OpenAI Agents SDK — ready-made harness for reuseCode execution sandboxes: E2B, Modal, Daytona, Anthropic "computer use" sandboxExternal protocols: MCP (Anthropic) for tools, A2A (Google) for inter-agent communicationObservability for agents: LangSmith, Langfuse, Helicone, BraintrustAgent attribution and identity — required for enterprise audit and complianceShared infrastructure for AaaS — Sierra, Decagon, Salesforce Agentforce combine harness + infra

How it works

The harness surrounding a model defines: (1) an execution loop — the strategy for successive steps (ReAct, plan-and-execute, reflection); (2) a tool interface — JSON schemas, parameter validation, retry logic; (3) a sandbox — isolated code execution environment (Docker/microVM); (4) memory — session context, scratchpad, long-term memory; (5) a system prompt and guardrails; (6) observability — traces, logs, evaluation. The infrastructure adds an inter-agent layer covering: (a) attribution of actions to a person or organization, (b) communication protocols (MCP for tools, A2A for agents), (c) reputation and oversight systems, (d) intervention mechanisms.

Problem solved

Agentic systems built directly on a raw LLM are uncontrollable, unsafe, and unmeasurable: no control loop, no execution isolation, no action attribution, no exchange protocols. Harness/Infrastructure provides a reusable engineering layer that gives agents observability, safety, identity, and the ability to collaborate.

Components

Control loopOrchestrate

Step strategy: ReAct, plan-and-execute, reflection, tree-of-thoughts.

Tool interfaceBridge

JSON schemas, parameter validation, retries, mapping to MCP / function calling.

Execution sandboxIsolate

Isolated environment (Docker, microVM, Firecracker) for the agent's code and system operations.

Memory subsystemRemember

Session context, scratchpad, long-term memory (vector store), and history compression.

Policy / guardrailsConstrain

Allowed tools, spend caps, escalation rules, risk classes, allowlists/blocklists.

Identity & attributionAttribute

Agent identity, action signing, mapping to a human/organizational principal (Chan et al. 2025).

Inter-agent communicationCommunicate

Protocols such as A2A (Google) and MCP (Anthropic) — standards for agent-to-agent and agent-to-tool exchanges.

Observability & evaluationObserve

Step tracing, tool logs, offline/online evaluation, replay and debugging.

Implementation

Reference implementations
LangGraph
OpenAI Agents SDK
Model Context Protocol
Agent2Agent Protocol (A2A)
E2B
Implementation pitfalls
Over-abstraction in the agent harnessHigh

Early frameworks overwhelm the model with layers of abstraction; Anthropic recommends starting with simple loops.

Lack of execution isolationCritical

Running agent-generated code in the host process is a critical security vulnerability.

Unbounded loops and runaway costsCritical

The absence of step, time, and spending limits leads to infinite loops and uncontrolled API costs.

Brak atrybucjiHigh

Without identity and signing, it is impossible to trace who or what performed a given action — blocking audit and enterprise adoption.

Eksplozja kontekstuHigh

Naively concatenating history and tool results quickly overflows the context window; compression or summarization is required.

Tool poisoning / prompt injectionCritical

Tool output may contain malicious instructions; the harness must treat all outputs as untrusted data.

Brak observabilityHigh

Without step-level tracing, debugging an agent is practically impossible.

Vendor lock-in: harness tied to specific modelMedium

Tight coupling to a specific SDK makes model or provider migration difficult.

Evolution

2022
ReAct (Yao et al.) — first widely adopted thought/action/observation agent loop, canonical foundation of the harness.
Inflection point
2023
OpenAI Function Calling — formal tool interface layer in the harness.
2023
AutoGPT and BabyAGI — first open-source harnesses with feedback loops and memory.
2024
Anthropic "Building effective agents" design guidelines published
2024
Anthropic Computer Use — sandbox + harness for GUI desktop control.
2024
Model Context Protocol (MCP, Anthropic) — first widely adopted tool-calling standard as infrastructure.
Inflection point
2025
Chan et al. "Infrastructure for AI Agents" (TMLR) — formalization of agent infrastructure as a distinct research area.
Inflection point
2025
Google A2A protocol released, complementary to MCP.
2025
OpenAI Agents SDK, LangGraph 0.x stable — opinionated harness frameworks mature.

Hyperparameters (configurable axes)

Loop strategyCritical

ReAct vs plan-and-execute vs reflection vs tree-of-thoughts.

Tool surfaceCritical

Number and granularity of tools exposed; competence-vs-hallucination trade-off.

Isolation levelHigh

None / process / container / microVM / hardware enclave.

Memory horizonHigh

Current context window only vs persistent long-term memory.

Policy strictnessHigh

Permissive (dev) vs strict (prod) — caps, allowlists, human escalation.

Identity modelMedium

Anonymous agent vs named agent bound to a human/organizational principal.

Execution paradigm

Primary mode
Conditional
Activation pattern
Input dependent