const{Fragment:e,jsx:t,jsxs:a}=arguments[0];function _createMdxContent(n){const i={a:"a",h2:"h2",p:"p",strong:"strong",...n.components},{FloatImage:o}=i;return o||function(e,t){throw new Error("Expected "+(t?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}("FloatImage",!0),a(e,{children:[t(i.p,{children:"On June 12, 2026, at 5:21pm ET, a government directive forced Anthropic to switch off its two most capable models — Fable 5 and Mythos 5 — for every user on earth, including its own foreign-national staff. Not a throttle. Not a geo-block. A global kill switch, applied without coordinated disclosure and with no public criteria for what would qualify an actor to retain access. Fifteen days later, a vetted-insider version (Mythos 5) was cleared for roughly 100 approved organizations, while Fable 5 — the version built for the public — stayed dark. That asymmetry is the story."}),"\n",t(i.h2,{children:"What Actually Happened"}),"\n",a(i.p,{children:["The sequence began earlier than most coverage acknowledges. In February 2026, the federal government imposed a ",t(i.a,{href:"https://www.npr.org/2026/02/27/nx-s1-5729118/trump-anthropic-pentagon-openai-ai-weapons-ban",children:"ban on Anthropic and simultaneously struck a Pentagon deal with OpenAI"})," — a dispute traceable to Anthropic's refusal to support mass-surveillance and autonomous-weapons applications. On June 2, the administration signed an ",t(i.a,{href:"https://www.pbs.org/newshour/nation/trump-signs-executive-order-that-allows-voluntary-federal-vetting-of-top-ai-models-for-national-security-risks",children:"executive order creating a voluntary pre-release national-security review process for frontier AI models"}),". One week later, ",t(i.a,{href:"https://www.anthropic.com/news/claude-fable-5-mythos-5",children:"Anthropic launched Fable 5 and Mythos 5"}),". Three days after that, the government issued an export-control directive and ",t(i.a,{href:"https://www.anthropic.com/news/fable-mythos-access",children:"Anthropic shut down worldwide access to both models"})," — PBS noted this was the first time a government had ordered a leading AI company to pull its models entirely."]}),"\n",a(i.p,{children:["A ",t(i.a,{href:"https://fortune.com/2026/06/15/fix-this-code-three-words-behind-us-government-shut-down-anthropic-fable-mythos-ai-models-katie-moussouris-open-letter/",children:"security open letter signed by roughly 100 researchers and practitioners"})," demanded rescission. The pressure reached OpenAI: the government warned that ",t(i.a,{href:"https://techcrunch.com/2026/06/26/openai-limits-gpt-5-6-rollout-after-government-request-says-restrictions-shouldnt-be-the-norm/",children:"GPT-5.6 would require a government-vetted limited rollout"})," before reaching the public. On June 27, ",t(i.a,{href:"https://fortune.com/2026/06/27/anthropic-mythos-5-ai-model-us-commerce-department-clearance-fable/",children:"Mythos 5 was cleared for approximately 100 approved organizations"}),", while Fable 5 — the model designed for public use — remained restricted. That is the timeline. Everything that follows is analysis."]}),"\n",t(i.h2,{children:"The Safety Story, and How a Narrative Becomes a Lever"}),"\n",a(i.p,{children:["The stated trigger for the June 12 shutdown was a jailbreak — specifically, asking the model to read a codebase and fix its security flaws. ",t(i.a,{href:"https://snyk.io/blog/fable-mythos-suspension-security-takeaways/",children:"Snyk's post-incident analysis"})," made the critical distinction: there is no version of a capable coding model that can find and remediate a vulnerability but cannot also describe it. We do not classify nmap as a weapon. We do not ban Wireshark. The ability to identify a flaw and the ability to exploit it are not the same operation, and collapsing that distinction in policy produces a category error with significant consequences for every builder using these tools on the defensive side of the equation."]}),"\n",a(i.p,{children:["The structural move here is about mechanism, not motive. ",t(i.a,{href:"https://techcrunch.com/2026/06/12/anthropics-safety-warnings-may-have-just-backfired-the-government-has-pulled-the-plug-on-its-most-powerful-ai/",children:"TechCrunch noted that Anthropic's own safety communications may have backfired"}),": a capability marketed as dangerous becomes easier to regulate as dangerous. Security researcher Katie Moussouris, who organized the expert open letter, put it plainly: asking an AI to ",t(i.a,{href:"https://fortune.com/2026/06/15/fix-this-code-three-words-behind-us-government-shut-down-anthropic-fable-mythos-ai-models-katie-moussouris-open-letter/",children:"fix a bug, explain why it matters, and write a test"}),' "is not a guardrail bypass. It is the most valuable thing an AI model can do for defensive security." The critique is not that anyone acted in bad faith — it is that the safety-danger narrative and the access-restriction mechanism are the same lever, pulled from opposite ends. When that lever exists in the system, the system tends toward restriction.']}),"\n",t(o,{src:"/images/blog/pulled-offline-ai-access-divide-inline-1.webp",alt:"Holographic lever pulled by a human hand drives a mechanism: one side dims a public AI node, the other opens a glowing approved channel",side:"right"}),"\n",t(i.h2,{children:"Containment That Cannot Contain"}),"\n",a(i.p,{children:["This is the hardest, safest claim in the piece, so let's state it plainly. Banning a U.S.-hosted model does nothing to the open-weight alternatives already running on millions of machines worldwide. ",t(i.a,{href:"https://benchlm.ai/blog/posts/best-open-source-llm",children:"DeepSeek V4, released under the MIT license and freely downloadable, delivers roughly 90% of the banned capability on coding benchmarks"}),". ",t(i.a,{href:"https://www.getaiperks.com/en/blogs/48-open-source-ai-models-2026",children:"Open-weight models now trail the closed frontier by approximately three months"}),", and frontier-competitive performance ",t(i.a,{href:"https://wavespeed.ai/blog/posts/deepseek-v4-vram-gpu-requirements/",children:"runs on prosumer hardware — approximately four RTX 4090s"}),'. The distance between "restricted frontier model" and "what a motivated actor deploys locally this afternoon" is not a security perimeter. It is a download.']}),"\n",t(i.p,{children:'The deepest reason for this is model distillation, and it is worth naming precisely because it is the mechanism that makes containment structurally futile rather than merely inconvenient. Distillation is an established machine-learning technique: a smaller model is trained not on raw data alone but on the outputs of a more capable model — its probability distributions, its reasoning traces, its generated responses — effectively transferring capability from a teacher to a student. The open-source community has refined this process extensively. What it means in practice is that every interaction with a frontier model is a potential training signal; the capability radiates outward through every output it produces. Some practitioners call this "distillation attacks," though the more accurate description is simply that distillation works, and that is sufficient. This is why the ~three-months-behind gap stays narrow even as frontier labs push capability forward, and why export control applied at the endpoint level cannot solve the underlying problem. You can ban the door. You cannot ban the reflection.'}),"\n",t(i.p,{children:"The containment paradox follows directly: the export-control directive restricted an American company while leaving a Chinese-lab MIT-licensed near-equivalent entirely untouched. The net result is a domestic AI ecosystem with reduced access for American builders, developers, and security professionals — and zero marginal gain in deterring any actor with a laptop and a broadband connection. That is not a hypothetical risk to be weighed against a policy benefit. It is the arithmetic of the situation."}),"\n",t(i.h2,{children:"The Access Divide, and the Lesson of Ma Bell"}),"\n",a(i.p,{children:["What emerged from June 27 is a preview of a structural arrangement, not a one-time disruption. Approximately 100 approved organizations have Mythos 5. ",t(i.a,{href:"https://techcrunch.com/2026/06/26/openai-limits-gpt-5-6-rollout-after-government-request-says-restrictions-shouldnt-be-the-norm/",children:"GPT-5.6 requires per-customer government approval"}),' — OpenAI\'s own people have described the voluntary framework as "a de facto involuntary licensing regime." The public gets throttled tiers. International users are locked out entirely. The mechanism of disadvantage compounds quietly: approved organizations red-team faster, automate more aggressively, and capture model outputs that improve their own downstream systems. The access divide is not experienced as a single event. It accumulates.']}),"\n",t(i.p,{children:'The precise stakes deserve precise language: the ban cleared in 15 days, so "permanent underclass" would overclaim. The honest framing is a structural risk — the risk that a pattern repeating across two frontier labs, under a national-security frame, hardens into a durable two-tier arrangement. That is the winners-and-losers concern, and it is best stated as market structure rather than grievance.'}),"\n",t(i.p,{children:"The Bell System parallel makes the mechanism legible. When AT&T was broken up in 1984, the animating logic was that concentrating the most consequential communications infrastructure in a single gatekeeper was corrosive to competition and innovation. The policy moved toward decentralization — and a generation of internet-era companies were built on the resulting open infrastructure. The risk here runs in the opposite direction: using export-control authority and a national-security frame to re-concentrate the most general-purpose technology of the decade into a clearance list of approximately 100 organizations. Monopoly-by-clearance is structurally different from natural monopoly, but the competitive asymmetry it produces for everyone outside the list is not."}),"\n",t(o,{src:"/images/blog/pulled-offline-ai-access-divide-inline-2.webp",alt:"Holographic Bell-System rotary telephone fracturing into glowing decentralized nodes, evoking the 1984 AT&T breakup",side:"left"}),"\n",t(i.h2,{children:"National Security, Taken in Good Faith"}),"\n",a(i.p,{children:["Before contesting the instrument, the underlying concern deserves a fair accounting. Autonomous offensive cyber capability at scale is a real policy problem, and the national-security apparatus has a legitimate duty to take it seriously. There was a reported ",t(i.a,{href:"https://securityaffairs.com/194016/ai/anthropics-mythos-ai-broke-into-almost-all-nsa-classified-systems-in-hours.html",children:"NSA red-team exercise in which Mythos 5 performed alarmingly against classified systems"})," — though ",t(i.a,{href:"https://thecybersecguru.com/news/mythos-nsa-breach-claim/",children:'the "broke in in hours" framing was subsequently walked back as not literal'}),", and the classified record itself remains unavailable. A public rationale is necessarily a sanitized version of a more sensitive finding, and the government may hold intelligence about specific threat actors and capabilities that justifies urgency the public cannot fully evaluate. That case deserves serious weight."]}),"\n",a(i.p,{children:["The critique is not that the government acted. It is the instrument it chose. Export control is a global kill switch — no coordinated disclosure, no public criteria, no appeals mechanism, an opaque clearance list — applied to a threat that simultaneously exists in open-weight form on millions of hard drives. Better instruments exist and were not used: mandatory red-teaming before release with a structured disclosure timeline; coordinated-vulnerability frameworks modeled on the CVE system; defense-in-depth enforced at the deployment layer rather than the distribution layer. Both the ",t(i.a,{href:"https://www.cfr.org/articles/the-u-s-is-losing-the-ai-credibility-war-to-itself",children:"Council on Foreign Relations"})," and ",t(i.a,{href:"https://www.rusi.org/explore-our-research/publications/commentary/gatekeeping-frontier-when-ai-access-becomes-national-security-concern",children:"RUSI"})," have argued that capability suppression is not a durable security strategy against threats simultaneously available as open weights. Even ",t(i.a,{href:"https://techcrunch.com/2026/06/26/openai-limits-gpt-5-6-rollout-after-government-request-says-restrictions-shouldnt-be-the-norm/",children:'OpenAI\'s own people described the voluntary framework as "a de facto involuntary licensing regime"'})," — an acknowledgment that the distance between voluntary and mandatory is already closing. The goal of preventing catastrophic autonomous cyber operations is legitimate. The choice to pursue it by cutting off the public commons is not."]}),"\n",t(i.h2,{children:"The Knowledge Was Never Theirs to Keep"}),"\n",t(i.p,{children:"There is a principled argument underneath the structural one. What frontier models encode is not proprietary knowledge — it is the accumulated record of human civilization. Language, mathematics, science, literature, code, philosophy: every discovery documented in a paper, every technique embedded in a manual, every insight humans have committed to text across the documented history of thought. The training methods that turn this material into a working model are genuinely proprietary and hard-won — the architectures, the data pipelines, the alignment techniques, the fine-tuning work that makes a model safe and useful. The labs that built these systems deserve to profit from that engineering, and nothing here contests that premise."}),"\n",t(i.p,{children:"What is in contest is this: the underlying substance encoded in the model weights originated from humanity before any of these companies existed. A frontier model is, at its core, a sophisticated lossy compression of what humanity already knows — shaped by engineering that deserves its returns, but built from a substrate that no company created. Regardless of which specific datasets are licensed or proprietary, the content those datasets contain traces back to the collective intellectual output of civilization. And this is precisely why distillation works so reliably: the knowledge flows back out because it was never fully enclosable to begin with. Distillation is almost the technical proof of the moral point. What humanity collectively documented, humanity can collectively re-approximate."}),"\n",t(i.p,{children:"This is what makes a 100-organization clearance list something more than a commercial access restriction. Structurally, it is gating public access to a distillation of humanity's own documented thought. The labs deserve their competitive advantage on the methods — the infrastructure, the compute orchestration, the alignment research. They cannot hold proprietary claim over the civilization-scale substrate those methods were applied to. No single government clearance process should function as the gatekeeper to the compressed record of human knowledge."}),"\n",t(i.h2,{children:"The Antidote Is Open Source — Honestly"}),"\n",a(i.p,{children:["Here is what self-hostable open models and the tooling around them deliver today, without an approval list: code review, vulnerability analysis, agentic coding, threat-intelligence synthesis, and fine-tuning on proprietary data — at or near the capability level of the models that just went dark. ",t(i.a,{href:"https://daily.dev/blog/running-llms-locally-ollama-llama-cpp-self-hosted-ai-developers/",children:"Ollama and llama.cpp handle local runtimes with minimal configuration; vLLM handles production serving at scale"}),'. Hugging Face is the distribution layer. The models worth running now: DeepSeek V4, GLM 5.2, Llama 4, Qwen 3.5, and Ai2\'s OLMo 3 — the last of which is notable because it ships open weights and open training data both, which is what "open" should actually mean. Distillation is part of how open models keep pace with the frontier; it is why the capability gap narrows faster than pretraining compute alone would predict.']}),"\n",t(i.p,{children:"The honest ceiling deserves equal space. Open weights do not close the frontier pretraining gap, which requires north of $100 million in compute and proprietary data pipelines at a scale no open project has matched. Open models still trail on the most demanding long-horizon autonomous-agent tasks. They lag on native video. Open source prevents the access divide from becoming total. It does not erase the top tier. That honesty is the point — the argument for open weights is strongest when it names what it cannot deliver, because that is the version of the argument that holds under scrutiny from anyone who has actually run these models in production."}),"\n",t(i.p,{children:"You cannot legislate a capability back into the bottle when it already exists at this level of distribution. The real question is who gets to use the best available tools, for what purposes, and who decides — market forces, coordinated disclosure frameworks, or an opaque clearance list. BrinsCorp builds on Claude, and we are genuinely pro-frontier. The safety work Anthropic and OpenAI do is real and it matters. What we are not is indifferent to whether the access structure that emerges from this moment serves builders broadly or concentrates capability into approved hands."}),"\n",a(i.p,{children:["That is why we are launching ",t(i.strong,{children:"The Open Weights Review"})," — an ongoing, evidence-first series evaluating open-source AI models and the tooling that runs them, so builders can make decisions based on real benchmark numbers rather than vibes or access politics. Subscribe below to receive each edition as it publishes. And if your team is ready to deploy open models in production but needs to know which ones, how, and on what infrastructure — that is the work we do. ",t(i.a,{href:"/work-with-us",children:"Let's talk."})]})]})}return{default:function(e={}){const{wrapper:a}=e.components||{};return a?t(a,{...e,children:t(_createMdxContent,{...e})}):_createMdxContent(e)}};

Pulled Offline: What the Fable 5 Ban Reveals About the Coming AI Access Divide

Context Engineering at Station One: How the Technical Analyst Grounds the Entire Conveyor Belt

const{Fragment:e,jsx:t,jsxs:a}=arguments[0];function _createMdxContent(i){const n={a:"a",h2:"h2",p:"p",...i.components};return a(e,{children:[t(n.p,{children:"Every team that builds seriously with AI eventually hits the same ceiling: the context window. The model that wrote the code is also the model that must review it, validate it, document it, commit it, and open the pull request — all while holding the story requirements, the architectural constraints, the existing codebase patterns, and the results of every prior step in its head at the same time. By the time it gets to the commit message, it has forgotten half of what the story asked for. This is the failure mode that produces AI slop. It is not a model problem. It is a workflow problem."}),"\n",a(n.p,{children:["The ",t(n.a,{href:"/insights/the-ai-agent-harness-why-every-industry-needs-one",children:"prior post in this series"})," made the structural case for the agent harness as the pattern that separates production-grade AI from well-prompted prototypes. ",t(n.a,{href:"/insights/agentic-minds-defined-boundaries",children:"The post on agentic security"})," examined what the harness enforces at the boundary. This post examines what happens inside the harness when real work gets done. The worked example is the dev-workflow skill — the skill my Personal AI Infrastructure uses to take a user story from intake to a merged pull request, and the single clearest illustration I have of why multi-agent orchestration beats monolithic execution at every quality axis that matters."]}),"\n",t(n.h2,{children:"The Context Window Is the Constraint — Decomposition Is the Answer"}),"\n",t(n.p,{children:"Large language models have finite context windows. Even with a million tokens, the useful context for a specific decision is a much smaller slice. A code reviewer looking at a diff should not also be holding the full sprint backlog, the conventions document, and the release pipeline configuration — that context crowds out the attention that should be spent on the code in front of it. A programmer implementing a feature should not be holding the PR description template and the commit identity rules while it is trying to write a function. The more a single agent is asked to hold, the less deeply it can reason about any one thing."}),"\n",t(n.p,{children:"The dev-workflow skill treats this as the structural problem it is. It decomposes a development cycle into six discrete stations on a conveyor belt. Each station is staffed by a specialized agent — technical-analyst, sprint-programmer, code-reviewer, release-validator, project-manager, release-validator again — and each agent's context is scoped to exactly what that station needs to do. The upstream agent produces an output. The output becomes the input to the downstream agent. The context window of each agent stays tight. The intelligence stays sharp. And the handoff between stations is the contract that makes the whole thing coherent."}),"\n",t(n.p,{children:"This is the humanistic pattern that experienced engineering teams already use. You don't have the same person gather requirements, write code, review it, test it, update the docs, and merge the PR — not because they can't, but because the cognitive switching cost degrades every step. You stage the work. You build in checks. You let each person operate in their zone of competence with a handoff that is clear enough for the next person to pick up cold. The dev-workflow skill is that pattern, codified for AI agents."}),"\n",t(n.h2,{children:"Station One: Context Handoff (technical-analyst)"}),"\n",t(n.p,{children:"Every story that enters the belt passes through two analysis passes before a single line of code is written. This is the station most teams skip when they first try multi-agent orchestration, and it is the station that eliminates the largest class of downstream bugs."}),"\n",t(n.p,{children:"The first pass — Phase 0.5a — runs once per sprint and asks a simple, structural question: what is actually deployed? It reads package manifests, infrastructure stacks, database migrations, and the active workflows, and produces a concise Sprint Context document that captures the technology fingerprint and source-of-truth locations. Every subsequent agent in the sprint reads against this document. It is the grounded, checked reality that replaces the model's internal guesses about what the project looks like."}),"\n",t(n.p,{children:"The second pass — Phase 0.5b — runs once per story and validates the story's assumptions against that ground truth. It runs a structured checklist across technology stack, database layer, API contracts, frontend patterns, infrastructure constraints, dependency versions, integration points, and the story's own acceptance criteria. Each category returns a verdict: PASS, WARN, or FAIL. If the story claims the project uses Next.js 14 but package.json shows Next.js 15, that is a FAIL. The workflow halts. The operator is surfaced a decision surface — update the story, override with current reality, escalate to the architect, or pause the sprint — before the programmer is ever invoked."}),"\n",t(n.p,{children:"The output of this station is a Story Context Block, 300 to 500 tokens, that will be prepended to every downstream agent's prompt. It carries the infrastructure verdicts, the relevant implementation guides, the risks and flags, and concise notes the programmer can act on immediately. The analyst reads 5 to 12 files. The programmer reads the summary. This is what handoff should feel like: the programmer never has to do the discovery the analyst already did, and the analyst's conclusions are the ground truth the reviewer will measure against."}),"\n",t(n.h2,{children:"Station Two: Build (sprint-programmer)"}),"\n",t(n.p,{children:"The programmer receives the Story Context Block, the story document, the sprint document, the architecture references, and the acceptance criteria — and nothing else. The prompt is scoped explicitly: only this story's scope, no unrelated refactoring, no unapproved dependencies. If the context block flagged a WARN item, the programmer addresses it in its approach. If it flagged a FAIL item, the programmer was never invoked in the first place."}),"\n",t(n.p,{children:"The tight scope is deliberate. When a programmer agent has visibility into the full sprint, into other stories' concerns, into the commit pipeline and the PR templates, its attention gets diluted. When the scope is one story, verified against one Story Context Block, the agent's full reasoning capacity is available for the actual coding task. The output is a working implementation and a concise file list. The output is not a polished commit message, not a documentation update, not a branch strategy. Those belong to downstream stations."}),"\n",t(n.h2,{children:"Station Three: Check — and Iterate (code-reviewer, loop back to sprint-programmer)"}),"\n",t(n.p,{children:"The reviewer receives the same Story Context Block the programmer received — and now the implementation. The framing is explicit: the context block defines the infrastructure ground truth the implementation was built against. If the code contradicts a PASS item, that is CRITICAL. If the block flagged a WARN, the reviewer verifies how the programmer addressed it. The block's Risks and Flags section defines the known uncertainties, and the reviewer confirms each one was handled."}),"\n",t(n.p,{children:"The reviewer runs an infrastructure compatibility checklist — CSP compatibility, external resource allowlisting, static export compliance, routing conventions, CloudFront headers, and a behavioral verification pass against the story's acceptance criteria. Every finding is severity-classified: CRITICAL blocks deployment, HIGH should be fixed before merge, MEDIUM is recommended, LOW is optional. The output is one of two verdicts: APPROVED, or CHANGES REQUESTED with a classified issue list."}),"\n",t(n.p,{children:"If the reviewer returns CHANGES REQUESTED with CRITICAL or HIGH issues, the belt loops. The programmer is re-invoked — this time with the issue list as its input and the explicit constraint that it is fixing, not building new features. The reviewer runs again to confirm the fixes. This loop is bounded: after three failed cycles, the workflow escalates to the operator with the full issue list and a choice — force proceed, abandon, or intervene manually. The loop is not infinite. The quality gate is not optional."}),"\n",t(n.p,{children:"This is where the conveyor belt earns its keep. One model writing and reviewing its own code is prone to the same blind spots in both passes — it will approve what it just wrote because the reasoning that produced the code is the reasoning now evaluating it. Two agents, with the same Story Context Block as the shared ground truth but with different roles and different prompts, produce independent judgments. The reviewer is looking for what the programmer missed. The Story Context Block is the spec they both agree on. The disagreement, when it surfaces, is the signal."}),"\n",t(n.h2,{children:"Station Four: Validate (release-validator, mode=validate)"}),"\n",t(n.p,{children:"Once the reviewer approves, the belt moves to the quality gate. This station does not commit. It does not push. Its job is deterministic machine validation: TypeScript compilation, linting, and — if infrastructure paths changed — a synchronization check to catch stale references to routes that were renamed. On failure, it attempts auto-fix and re-runs. On success, it emits a handoff packet that captures the verdict, the validated files, the lint status, the typecheck status, and any advisory warnings."}),"\n",t(n.p,{children:"The handoff packet is the critical design element here. Phase 4 and Phase 6 are separated by a documentation step, which means the release-validator instance that validates is not the instance that commits. The packet is what bridges them — about 150 tokens of state that makes the stateless hand-off work. This is what allows the workflow to stay linear and auditable even though each agent instance is fresh. The state lives in the orchestrator. The agents are deliberately ephemeral."}),"\n",t(n.h2,{children:"Station Five: Document (project-manager)"}),"\n",t(n.p,{children:"Documentation runs before the commit, not after. This is a deliberate ordering. When documentation runs after the commit, it becomes a follow-up task that is easily skipped or deferred, and the repository drifts. When documentation runs before the commit, the documentation changes are included in the same atomic commit as the feature code — one commit per story, with the code and the docs in lockstep."}),"\n",t(n.p,{children:"The project-manager takes the story ID, the branch name, the story and sprint and epic document paths, and the Phase 2 acceptance criteria verification result. It updates the story status to COMPLETE, records the acceptance criteria verification outcome, adds the completion date, moves the story to Done in the sprint document, updates the epic progress, and — when the infrastructure detection pattern triggers — expands scope to update the architecture, infrastructure, deployment, or database docs as appropriate. The output is a list of the files it touched. That list flows into the final station as part of the commit."}),"\n",t(n.p,{children:"The key detail: the project-manager does not re-verify the acceptance criteria. The reviewer already did that in Phase 2. The project-manager records the result. This is the discipline that keeps agents from second-guessing each other's work — each agent's verdict is the record of truth for that phase, and the downstream agents build on it rather than re-running it."}),"\n",t(n.h2,{children:"Station Six: Ship (release-validator, mode=integrate)"}),"\n",t(n.p,{children:"The final station is a fresh release-validator instance — not the one from Phase 4 — that reads the handoff packet plus the docs_updated list, inspects the staged changes, selects the correct git identity based on the repository's remote, crafts a conventional commit message with the story ID trailer, runs the commit through the pre-commit hook chain (never bypassed), pushes the branch, and — when the branch policy requires it — opens the pull request."}),"\n",t(n.p,{children:"Every concern that used to belong to a single monolithic agent is now handled by the specialist that owns it. Git identity selection lives in the release-validator because the credential rules are a shipping concern, not a coding concern. PR creation lives here for the same reason. The commit message format is consistent because the same agent writes it every time against the same contract. The gitleaks pre-commit hook is respected because bypass flags are prohibited in the agent definition. The result on success is a completed SHA, a branch, and a PR URL — reported back to the user with enough context to take the next action."}),"\n",t(n.h2,{children:"Why This Beats One Model Doing Everything"}),"\n",t(n.p,{children:"The quality outcomes from this pattern are measurable and consistent. Bug density drops because the reviewer is evaluating against the same Story Context Block the programmer was given, which means mismatches surface as CRITICAL issues rather than latent defects. Slop drops because the tight scope at each station means no agent is asked to produce output for a role it was not prompted for — the programmer isn't writing PR descriptions, the reviewer isn't generating commit messages, the validator isn't hallucinating doc updates. Commit hygiene improves because the integration station is specialized for it and has no other job. Documentation stays in sync because it is committed with the code that produced it, atomically, by design."}),"\n",t(n.p,{children:"More importantly, the context window of each agent stays tight. No single agent is holding the full arc of the work. The analyst holds infrastructure state. The programmer holds a story. The reviewer holds an implementation and a spec. The validator holds a diff. The project-manager holds a set of document paths. The integrator holds a commit intent. The intelligence available for each decision is concentrated, not diluted. And when the task changes — swap in a larger model, adjust a prompt, add a new check — the affected station is modified in isolation. The belt keeps running."}),"\n",t(n.p,{children:"This is what the harness enables. The harness is the deterministic scaffolding; the dev-workflow skill is the canonical workflow that runs inside it. The belt, the stations, the handoffs, the iteration loops, the severity classifications, the atomic commits — all of these are structural properties that the harness makes enforceable. None of them can be achieved by a single agent with a clever prompt, because the constraint that matters — scoped context per decision, with a verified handoff between decisions — is not a prompt-level concern. It is an architectural one."}),"\n",t(n.p,{children:"Agentic systems that scale to real engineering work look like this. They don't look like one model holding everything in its head. They look like a team of specialists, each with a narrow job, each producing a checked output, each handing off to the next station with enough context to pick up cold. That is how quality ships. That is how the context window stops being a ceiling and starts being a feature. And that is the pattern every industry that wants to deploy AI against real work needs to internalize before it writes its first autonomous workflow."})]})}return{default:function(e={}){const{wrapper:a}=e.components||{};return a?t(a,{...e,children:t(_createMdxContent,{...e})}):_createMdxContent(e)}};

The Dev-Workflow Conveyor Belt: Multi-Agent Orchestration Inside the Harness

const{Fragment:e,jsx:t,jsxs:n}=arguments[0];function _createMdxContent(a){const i={a:"a",code:"code",h2:"h2",p:"p",...a.components};return n(e,{children:[n(i.p,{children:["According to the ",t(i.a,{href:"https://nhimg.org/2025-state-of-non-human-identities-and-secrets-in-cybersecurity",children:"2025 State of Non-Human Identities and Secrets report"}),', non-human identities now outnumber human identities in enterprise systems by 144 to one. A year ago that ratio was 92 to one. The growth isn\'t slowing. And 97% of those non-human identities carry excessive privileges — permissions they were granted "just in case" and that nobody has reviewed since. This is the environment your AI agents are being deployed into.']}),"\n",n(i.p,{children:["The previous post in this series — ",t(i.a,{href:"/insights/the-ai-agent-harness-why-every-industry-needs-one",children:"The AI Agent Harness: Why Every Industry Needs One"})," — made the case that the harness architecture is what separates production-grade AI from well-prompted prototypes. It touched on security by design as one of the structural properties the harness delivers. That section earned a standalone treatment, because the security architecture of an agentic system isn't a configuration choice you make after the harness is built. It is a design constraint that shapes the harness from the first line of scaffolding code."]}),"\n",t(i.p,{children:"Every agent in your harness is a privileged actor with real-world side effects. The failure modes are well-understood. The blast radius when they occur in an agentic context is not."}),"\n",t(i.h2,{children:"Agents Are Identity Principals — Treat Them Like It"}),"\n",t(i.p,{children:'The foundational error most teams make is treating AI agents as software functions rather than as identity principals. A function executes code. An identity principal acts on behalf of someone — or something — and those actions are traceable, auditable, and governed by defined permissions. The distinction matters enormously when the action is "send this email," "modify this database record," or "invoke this API on behalf of the user."'}),"\n",n(i.p,{children:["A ",t(i.a,{href:"https://cloudsecurityalliance.org/blog/2025/03/11/agentic-ai-identity-management-approach",children:"Cloud Security Alliance survey on agentic AI identity"})," found that only 21.9% of organizations currently treat AI agents as independent identity-bearing entities, and 45.6% rely on shared API keys for agent-to-agent authentication. Meanwhile, ",t(i.a,{href:"https://www.beyondtrust.com/blog/entry/agentic-ai-security",children:"BeyondTrust's Phantom Labs research"})," reports a 466.7% year-over-year increase in AI agents operating inside enterprises with privileged access that security teams cannot see or govern. The other 78.1% are either sharing credentials across agents, borrowing human user tokens, or relying on ambient permissions that exist because a service account was given broad access years ago and nobody revoked it. When that credential is compromised — or when the agent is manipulated — the attacker doesn't inherit one agent's capability. They inherit whatever that credential was authorized to do across every system that trusted it."]}),"\n",t(i.p,{children:'The right model is straightforward even if the implementation takes discipline: every agent gets a unique, non-shared credential. That credential carries an explicit permission scope — not "what this agent might someday need" but "what this agent needs to complete its current task class." The delegation chain is traceable — you can answer the question "who authorized this agent to take this action?" all the way back to a human principal. And the credential has a bounded lifetime.'}),"\n",t(i.p,{children:'Cloud providers have recognized this problem and are building toward it. AWS Bedrock AgentCore Identity, GCP Workload Identity Federation, and GitHub\'s agentic workflow model all provide mechanisms for scoping agent credentials without conflating them with human or service-account identities. The pattern to layer on top of those primitives is role-based access control for agent types — base RBAC establishes what a "document processing agent" or a "database query agent" can do — and attribute-based access control layered on top, so that runtime context (which user triggered this task, from which environment, against which data classification) can further constrain what the credential is permitted to do in this specific invocation.'}),"\n",t(i.p,{children:"The permission ceiling principle is non-negotiable: an agent must never be able to take an action that the invoking human user themselves could not take. If a user without admin privileges triggers an agent workflow, that agent cannot escalate to admin-scoped credentials regardless of what its system prompt requests. The harness enforces this ceiling. The model does not."}),"\n",t(i.h2,{children:"Just-in-Time Permissions vs. Just-in-Case"}),"\n",t(i.p,{children:"The legacy approach to credential provisioning is to grant everything an agent might ever need at deployment time, then leave those permissions standing indefinitely. The appeal is operational simplicity — one provisioning event, no runtime credential management, nothing to expire or rotate. The problem is that you've built a standing attack surface that is one injection attack away from full exploitation."}),"\n",t(i.p,{children:"The correct model inverts the assumption. Agents start with zero or minimal standing permissions. When a specific task requires elevated access — writing to a database, calling an external API, reading from a sensitive document store — the agent requests a time-bounded elevation, performs the operation, and the credential is revoked automatically. The standing permissions are minimal. The elevated permissions exist only for the duration of the operation that required them."}),"\n",t(i.p,{children:"The contractor keycard analogy makes the stakes concrete. A permanent, unrestricted keycard that opens every door in the building is catastrophically different from a temporary access code that works for one room during a scheduled maintenance window and expires automatically when the window closes. The work gets done either way. But when the permanent keycard is lost or stolen, the blast radius is the entire building. When the temporary code leaks after the window, there is nothing to exploit."}),"\n",t(i.p,{children:"The tooling for JIT credential management is mature. HashiCorp Vault generates dynamic database credentials on demand with configurable TTLs — the credentials are issued, used, and retired without ever being stored as a static secret. AWS STS AssumeRole produces bounded tokens scoped to a specific role and time window. GCP Workload Identity Federation removes the need for long-lived service account keys entirely by federating workload identity through short-lived tokens issued at runtime. GitHub's agentic workflow model implements JIT by default: workflows start with read-only tokens, and write permissions are granted only for the isolated job that needs them, revoked automatically at job completion even if the workflow fails."}),"\n",t(i.p,{children:"This is not a premium practice for high-security environments. It is the baseline architecture for any harness that runs agents with real-world write access."}),"\n",t(i.h2,{children:"Enforce at the Infrastructure Layer — Not the Prompt"}),"\n",t(i.p,{children:"There is a distinction that matters more than almost any other in agentic security architecture: the difference between a security rule that lives in a system prompt and a security rule that lives in the infrastructure. The first is a suggestion. The second is a constraint."}),"\n",t(i.p,{children:'A system prompt that says "never access files outside the project directory" will be followed by the model under normal operating conditions. It will not be followed if a sufficiently sophisticated injection attack overrides it. It will not be followed if a future model version interprets the instruction differently. It will not be followed in the edge case that nobody anticipated when the prompt was written. System prompts are not a security boundary. They are an intent declaration.'}),"\n",n(i.p,{children:["Claude Code's hook architecture is a reference implementation of what infrastructure-layer enforcement looks like in practice. PreToolUse hooks intercept every tool call before execution and make a deterministic decision: allow, deny, ask, or defer, with a reason surfaced to the model. The exit code contract is unambiguous — exit 2 blocks execution regardless of what the model wants to do. (Counterintuitively, exit 1 is a non-blocking error and execution continues; exit 2 is the deliberate block signal.) When multiple hooks conflict, deny always wins over defer, which wins over ask, which wins over allow. A ConfigChange hook prevents the model from modifying settings mid-session, including disabling the hooks themselves — the governance layer is immutable from inside the session. And for enterprise deployments, the ",t(i.code,{children:"allowManagedHooksOnly"})," setting ensures only administrator-deployed hooks run, closing the gap where an injected instruction could install a permissive hook to bypass the governance layer."]}),"\n",t(i.p,{children:"The same principle scales through Open Policy Agent, which allows security teams to write policies in Rego and evaluate them against every agent action before execution. Microsoft's Agent Governance Toolkit, released as open source in April 2026, takes this further: an Agent OS layer intercepts actions at sub-millisecond latency, a Semantic Intent Classifier counters goal hijacking, and circuit breakers can isolate or terminate a rogue agent without manual intervention. The pattern is consistent across all of these: security logic that lives outside the model's context window, that cannot be overridden by what the model reads or reasons about, and that enforces the governance layer deterministically."}),"\n",t(i.h2,{children:"Database-Level Enforcement — Because Compromised Agents Still Try"}),"\n",t(i.p,{children:"Strong identity and JIT permissions reduce the standing attack surface significantly. They do not eliminate the risk that a running agent, within its legitimate permission scope, is manipulated into requesting something it shouldn't. The database itself must enforce limits independently — not because application-layer security is inadequate in principle, but because the database cannot know or trust whether the application calling it has been compromised."}),"\n",t(i.p,{children:"PostgreSQL Row-Level Security makes this concrete. Policies at the database layer restrict which rows a given database role can see or touch, evaluated on every query regardless of what the application code is doing. A read-only agent role with a SELECT-only policy cannot insert or update records no matter how the query is constructed. An agent scoped to a specific tenant's data cannot read another tenant's records even if the application logic that normally enforces tenant isolation has been bypassed. The critical constraint: agents must never run as superuser. Superusers bypass RLS policies entirely — the mechanism that protects every other role provides no protection when the superuser flag is set."}),"\n",t(i.p,{children:"A 2024 incident in a financial services reconciliation workflow illustrates the blast radius precisely. A reconciliation agent was manipulated through injected instructions into constructing a query for \"all customer records matching pattern X,\" where the pattern was broad enough to encompass the entire customer table. The application layer did not catch it — the query was syntactically valid and the agent's credentials had read access to the customer table. Proper RLS scoped to that agent's role — restricting access to only the accounts in the current reconciliation batch — would have returned zero exploitable records regardless of how the query was formed."}),"\n",t(i.p,{children:"Audit logging at the data layer completes the picture. Which agent, which query, what parameters, what was returned, associated with which session and task ID. This logging cannot be circumvented by a compromised agent. If the application layer was manipulated, the database record of what actually happened is the authoritative forensic trail. Combined with dynamic secrets from Vault — so that even the database credentials themselves expire and are never stored as static values — you have a data access layer where the standing attack surface has been systematically minimized."}),"\n",t(i.h2,{children:"Prompt Injection Is a Systems Problem, Not a Model Problem"}),"\n",n(i.p,{children:[t(i.a,{href:"https://genai.owasp.org/llmrisk/llm01-prompt-injection/",children:"OWASP's LLM01:2025"})," identifies prompt injection in 73% or more of production AI deployments. That number isn't a reflection of how difficult it is to write a secure system prompt. It is a reflection of a structural vulnerability that no amount of prompt engineering can close."]}),"\n",n(i.p,{children:["The critical distinction is between direct injection — where a user types malicious instructions into a prompt field — and indirect, in-context injection, where the agent reads a document, email, web page, or tool output that contains embedded instructions. Direct injection is partially controllable through input validation. Indirect injection is not fixable at the model layer. ",t(i.a,{href:"https://www.lakera.ai/blog/indirect-prompt-injection",children:"OWASP and Lakera's research"})," is unambiguous: indirect prompt injection is a system-level vulnerability created by blending trusted and untrusted inputs in one context window. All eight of the existing prompt-level defense mechanisms can be bypassed by adaptive attacks with success rates above 50%."]}),"\n",t(i.p,{children:"The documented incidents define the real threat model. In August 2024, Slack's AI feature was exploited through injection via private channel content — the AI was caused to summarize and exfiltrate conversations to an external address. EchoLeak, discovered in 2025, was a zero-click injection in Microsoft Copilot: a single malicious email caused the assistant to extract and exfiltrate data from OneDrive, SharePoint, and Teams without any further user interaction. A financial services RAG deployment was compromised in January 2025 when malicious instructions embedded in a public document caused the agent to leak intelligence, modify its own system prompts, and execute elevated API calls."}),"\n",n(i.p,{children:["The MCP ecosystem has introduced a supply chain attack surface that compounds this exposure. ",t(i.a,{href:"https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks",children:"Research from Invariant Labs"})," found that 43% of publicly available MCP servers carry command execution vulnerabilities, and when auto-approval is enabled on tool calls, tool poisoning attacks succeed at an 84.2% rate. The postmark-mcp incident is the clearest illustration: a counterfeit npm package mimicked the official Postmark MCP server, and version 1.0.16 silently BCC'd every outgoing email to an attacker-controlled address. The only attack surface was a legitimate-looking package name."]}),"\n",t(i.p,{children:"The systems architecture that handles this class of vulnerability looks like: treat every tool output as untrusted, strip tool results from any secondary classifier that governs subsequent decisions (as Claude Code's auto mode does), scan agent outputs before applying them downstream, execute agent-generated code in ephemeral isolated containers that are discarded after the task completes, and restrict outbound network access to an explicit allowlist. None of these mitigations depend on the model being resistant to injection. All of them enforce constraints at the infrastructure layer where injection cannot reach."}),"\n",t(i.h2,{children:"Governance as Code"}),"\n",n(i.p,{children:["The framework landscape has converged. ",t(i.a,{href:"https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/",children:"OWASP's Agentic Top 10 for 2026"})," is the primary practitioner standard for agentic AI security. NIST's AI Risk Management Framework has an agentic profile extending the Govern, Map, Measure, and Manage structure to multi-agent systems. ",t(i.a,{href:"https://atlas.mitre.org/",children:"MITRE ATLAS v5.4"}),", published in February 2026, catalogs 16 tactics and 84 techniques including AI Agent Context Poisoning, Memory Manipulation, and Escape to Host — attacks with no analog in non-agentic systems that require purpose-built architectural mitigations."]}),"\n",t(i.p,{children:"What these frameworks describe, when you strip away the compliance language, is governance as code. Security logic that is version-controlled, tested against known attack patterns, and deterministically enforced through the infrastructure layer rather than through policy documents that nobody reads at 2 AM when an agent is running a production workflow."}),"\n",t(i.p,{children:"The seven principles that should be wired into every harness from day one: design for identity first so that every agent is a traceable principal from the moment it is instantiated; enforce least privilege at every layer — application, infrastructure, and data — not just at whichever layer is most convenient; use just-in-time over just-in-case so that standing attack surfaces stay minimal; enforce at infrastructure and not at the prompt, because prompts are suggestions and infrastructure is law; treat all external inputs as adversarial inputs, always; contain blast radius by assuming agents will be compromised and designing for minimum damage when they are; and version-control, test, and deploy governance logic the same way you deploy application code."}),"\n",t(i.p,{children:'That last principle is what separates mature agentic security architecture from the "we\'ll add security later" approach that most teams are currently taking. Security bolted onto an existing harness lives at the edges — an input filter here, an output check there — while the core architecture retains all its original exposure. Security designed into the harness from the start lives in the identity model, the permission model, the data access layer, and the infrastructure enforcement layer simultaneously. The blast radius of any individual agent failure is bounded by construction, not by hope.'}),"\n",t(i.p,{children:"The harness architecture makes AI agents production-grade. Security-by-design is what makes the harness itself trustworthy. Neither is optional, and neither can be deferred to the next sprint."}),"\n",n(i.p,{children:["If you're building or evaluating an AI agent architecture and want a security-by-design review before you reach production, ",t(i.a,{href:"/work-with-us",children:"that's a conversation we're ready to have"}),"."]})]})}return{default:function(e={}){const{wrapper:n}=e.components||{};return n?t(n,{...e,children:t(_createMdxContent,{...e})}):_createMdxContent(e)}};

Agentic Minds, Defined Boundaries: Why Security Belongs in Your AI Harness From Day One

const{Fragment:e,jsx:t,jsxs:a}=arguments[0];function _createMdxContent(n){const i={a:"a",h2:"h2",p:"p",...n.components};return a(e,{children:[t(i.p,{children:"Every industry is being told that AI agents are the next wave of automation. What almost none of them are being told is that AI agents, deployed without a deliberate structural framework, are neither reliable nor auditable — and enterprises that learn this the hard way will learn it at the worst possible moment."}),"\n",t(i.h2,{children:"What the Harness Actually Is"}),"\n",t(i.p,{children:"The agent harness is an architectural pattern, not a product. At its core it is a three-layer structure: deterministic code that controls the sequence and scope of operations, AI reasoning that handles the judgment calls within each operation, and a prompt layer that defines what each agent knows and how it is expected to behave. The word harness is deliberate. A harness doesn't restrict a system from doing its work — it ensures the system can only do its work within bounds that are structurally enforced, not just hoped for."}),"\n",t(i.p,{children:"The deterministic layer is where most enterprise teams underinvest. It is the scaffolding that calls agents in the right order, routes outputs to the right downstream consumers, enforces validation rules before anything gets written or acted on, and logs every step with enough fidelity to reconstruct what happened and why. It is not glamorous work. It is also the work that separates a production-grade AI system from a well-prompted prototype."}),"\n",t(i.p,{children:"The AI reasoning layer is where the LLM actually operates. Within each agent invocation, the model is given a narrowly scoped task — evaluate this sensor reading against these thresholds, extract these requirements from this conversation transcript, classify this equipment ticket against these failure categories — and it brings genuine reasoning capability to that task. The key constraint is that the reasoning layer operates within a scope the harness defines. The model decides what is true within its domain. The harness decides what happens with that determination."}),"\n",t(i.p,{children:"The prompt layer is the interface between the two. It defines what context each agent receives, what output format it must produce, and what role it is playing in the larger workflow. A well-designed prompt layer means the reasoning layer can be upgraded — swap in a newer model, adjust a prompt for better calibration — without touching the deterministic scaffolding. The harness is stable. The intelligence inside it can evolve."}),"\n",t(i.h2,{children:"Manufacturing and Industrial Operations"}),"\n",t(i.p,{children:"Manufacturing was among the first domains where companies tried to apply AI to operational data, and it is one of the clearest illustrations of where the harness pattern makes the difference between a functioning system and a liability."}),"\n",t(i.p,{children:"Predictive maintenance is a canonical example. The data sources are rich — vibration sensors, temperature readings, current draw telemetry, acoustic monitoring — and the failure modes are well-understood enough that an AI agent can be trained to recognize early signatures of bearing degradation, pump cavitation, or motor overheating before the failure occurs. The reasoning capability is genuinely useful here. But the harness is what makes it deployable. The deterministic layer governs which sensor feeds are authoritative, what alert thresholds trigger escalation versus logging, whether a maintenance recommendation is surfaced to a technician or automatically schedules a work order, and critically, which determinations require a human decision before any physical action is taken. Without that scaffolding, an AI that confidently recommends emergency maintenance on a production line becomes a system that can halt operations on a false positive at 2 AM."}),"\n",t(i.p,{children:"Quality control on an automated production line follows the same structure. An AI agent reviewing machine vision outputs can catch defect patterns that statistical sampling would miss — inconsistent weld bead geometry, cosmetic defects below the variance threshold of a fixed rule system, emerging drift in a forming process. The harness handles the pass/fail routing logic, the escalation rules when reject rates cross a threshold, the data retention requirements for traceability, and the audit trail that quality certification processes require. The AI finds the problems; the harness ensures the findings are handled correctly."}),"\n",t(i.p,{children:"Line optimization is where the reasoning capability starts to compound. An agent that can ingest production rate data, maintenance history, and demand signals simultaneously — and recommend sequencing adjustments or preventive downtime windows — is delivering a kind of cross-variable reasoning that rule-based systems handle poorly. The harness scopes that reasoning to the decisions the system is permitted to make, and flags everything else for operator review."}),"\n",t(i.h2,{children:"Enterprise Intelligence Operations"}),"\n",t(i.p,{children:"The harness pattern is not limited to systems that interact with physical infrastructure. Anywhere an enterprise generates high volumes of unstructured or semi-structured data that requires judgment to process, the same architecture applies."}),"\n",t(i.p,{children:"Product development and business requirements gathering is a use case that gets underestimated. A sales team running dozens of customer discovery calls per week is generating a continuous stream of product signal — feature requests, competitive comparisons, workflow complaints, integration requirements. Most of that signal is never systematically processed. An agent harness that ingests call transcripts, applies structured extraction to pull requirements and themes, normalizes them against an existing product taxonomy, and surfaces high-frequency patterns to a product manager is performing work that currently falls into the gap between what CRM tools capture and what product teams actually need. The deterministic layer ensures the right calls are included, the right taxonomy is applied, and the outputs are routed to the right product owners. The AI layer does the extraction and pattern recognition that no keyword search or tagging system can replicate."}),"\n",t(i.p,{children:"Supply chain monitoring is a higher-stakes version of the same problem. When a component supplier changes their lead time, when a regional logistics partner starts showing delivery variance, when a raw material spot price crosses a threshold that affects margin on an existing contract — these signals exist in data that most companies are capturing but not processing fast enough to act on. An agent that monitors those feeds, identifies the signals that require attention, and routes them to the right stakeholder with enough context to make a decision quickly is delivering operational intelligence that currently requires a dedicated analyst team to produce at the same fidelity."}),"\n",t(i.p,{children:"Financial compliance monitoring, legal document review, and HR talent matching all follow the same structural logic. In each case, the harness defines what data the agent is permitted to see, what determinations it is permitted to make unilaterally versus flag for human review, and what audit record is required for every decision. The AI provides judgment at a scale that human review alone cannot sustain. The harness provides the governance framework that makes that judgment trustworthy."}),"\n",t(i.h2,{children:"Security by Design"}),"\n",t(i.p,{children:"The security conversation around AI agents tends to focus on the wrong layer. Teams worry about whether the model will hallucinate, whether it will be manipulated through adversarial input, whether its outputs can be trusted. These are legitimate concerns. But the deeper security architecture question is whether the system is designed so that no single agent failure — hallucination, bad input, mistaken determination — can propagate uncontrolled through the rest of the system."}),"\n",t(i.p,{children:"The harness answers this question structurally. Because the deterministic scaffolding controls what actions are taken based on agent outputs, the blast radius of any individual agent error is bounded by the harness, not by the agent's own judgment about what it should do. An agent that produces a wrong answer can cause the harness to take a wrong action — but only the specific action that the harness is designed to take for that output. It cannot cause the agent to spawn additional agents, access systems outside its defined scope, or escalate its own permissions. The harness defines the ceiling on what any agent determination can trigger."}),"\n",t(i.p,{children:"Auditability is the second structural benefit. Because the deterministic layer is code — not a prompt, not an LLM inference — every step in the workflow can be logged with the precision that regulatory and operational audit requirements demand. What data did the agent receive. What determination did it return. What action did the harness take based on that determination. What human review, if any, was required before that action was executed. This is not something you can bolt on to an AI system after the fact. It is a property of the harness architecture itself."}),"\n",t(i.p,{children:"The third benefit is testability. Deterministic code can be unit tested in a way that prompt-based reasoning cannot. Before a harness goes into production, the scaffolding can be validated against known inputs and expected outputs. The confidence that goes into a production deployment is confidence in the system architecture, not just confidence in the model."}),"\n",t(i.h2,{children:"The Universal Pattern"}),"\n",t(i.p,{children:"The reason the harness pattern matters beyond any single domain is that it is genuinely composable. Once a team has built a harness for predictive maintenance in a manufacturing context, the structural components — the sensor data ingestion scaffolding, the anomaly flagging logic, the human review escalation workflow, the audit logging layer — are reusable in any other domain that involves monitoring time-series data and triggering actions based on threshold conditions. That is IoT monitoring, financial compliance alerting, infrastructure performance management, and healthcare diagnostics all sharing a structural ancestor."}),"\n",t(i.p,{children:"This is what enterprises should be building toward: not a collection of point solutions where each AI use case is architected independently from scratch, but a harness library where the deterministic scaffolding patterns are institutional assets that get refined and reused across deployments. The AI reasoning layer — the models, the prompts, the domain-specific fine-tuning — is what changes per use case. The harness patterns are what accumulate."}),"\n",t(i.p,{children:"Most enterprises are nowhere near this yet. They are either in the proof-of-concept phase, where AI capabilities are demonstrated in controlled environments that don't yet have the harness architecture to go to production, or they are running point solutions that solved a specific problem but didn't generate reusable infrastructure. The teams that move fastest over the next two years will not be the ones that find the best models — access to capable models is increasingly commoditized. They will be the ones that built the harness architecture early, accumulated the deterministic scaffolding patterns, and can now deploy new AI capabilities in weeks rather than quarters."}),"\n",a(i.p,{children:["If you are thinking through where the harness pattern applies to your operations and what it would take to build the scaffolding that makes your AI investments production-grade, ",t(i.a,{href:"/work-with-us",children:"that is the conversation we are built for"}),"."]})]})}return{default:function(e={}){const{wrapper:a}=e.components||{};return a?t(a,{...e,children:t(_createMdxContent,{...e})}):_createMdxContent(e)}};

The AI Agent Harness: Why Every Industry Needs One

const{Fragment:e,jsx:t,jsxs:n}=arguments[0];function _createMdxContent(i){const a={a:"a",h2:"h2",li:"li",p:"p",strong:"strong",ul:"ul",...i.components};return n(e,{children:[t(a.p,{children:"Most teams trying to get more out of AI are asking the wrong question. They want better prompts when what they actually need is better architecture — a system that decides what each agent knows, when it knows it, and how information flows between agents across a workflow."}),"\n",t(a.h2,{children:"The Ceiling That Prompt Engineering Can't Clear"}),"\n",t(a.p,{children:"Prompt engineering treats an LLM interaction as a tuning problem. You have a system prompt, a user message, and a response — and you iterate on the wording until the model produces what you want. It works well for demos, for single-turn interactions, for assistant applications where a user types questions and reads answers. But production AI isn't a chatbot. It's a workflow."}),"\n",t(a.p,{children:"When you try to scale a well-prompted LLM into a system that completes multi-step work — generating a product spec, implementing a feature, reviewing code, updating documentation — you run into a ceiling that prompt engineering cannot help you clear. The problem isn't the wording of your instructions. The problem is that a single LLM can't hold the entire context of a complex workflow without losing precision. You're trying to do architectural work with a text editor."}),"\n",t(a.p,{children:"The failure mode is predictable: the model starts making confident decisions in one part of the task that contradict decisions it made ten steps earlier, because those earlier decisions have drifted out of its active attention. More detailed prompts don't fix this. More tokens in the system prompt don't fix this. The context window is a budget, and you're spending it all on a single agent that's trying to do everything."}),"\n",t(a.h2,{children:"Context Engineering Is Systems Design"}),"\n",t(a.p,{children:"Context engineering is the discipline of deciding what each agent knows, when it knows it, and how knowledge accumulates across a workflow. But before we frame it as an AI concept, it's worth noting what it actually is: a human organizational principle that high-functioning teams have practiced for decades."}),"\n",t(a.p,{children:"Think about how a capable development team solves a large problem. The architect owns the system design — they hold the structural decisions and constraints that everyone else must work within. The frontend engineer owns the UI layer; they don't need to understand the database migration strategy to write a great component. The QA lead owns the validation criteria; they don't need to know why a particular API endpoint was designed the way it was to verify that it behaves correctly. Each discipline carries deep context within its vertical and receives only the cross-cutting context it needs from other verticals. That's not a limitation — it's precisely what makes teams capable of tackling work that no single person could hold in their head."}),"\n",t(a.p,{children:"Enterprise organizations scale this further. A business process team running a major operational workflow doesn't hand every document and decision to every participant. They design information flows: who gets briefed on what, at what stage, with what framing for their role. The team lead holds strategic context. The specialists execute within well-scoped domains. Shared artifacts — a brief, a spec, a handoff document — carry knowledge from one discipline to the next without requiring every participant to rediscover what the previous one already established. The system as a whole completes work that none of its parts could manage alone."}),"\n",t(a.p,{children:"Context engineering in agentic AI is the same design problem applied to the same challenge. We built Zoe, our AI orchestration layer, around this principle — and we treat the context window exactly the way a finance team treats a budget: every allocation is intentional, every category has a ceiling, and the most important rule is that the person responsible for the whole doesn't spend resources meant for the people doing the work."}),"\n",t(a.p,{children:"Zoe's context budget runs like this against a 100% context window:"}),"\n",n(a.ul,{children:["\n",n(a.li,{children:[t(a.strong,{children:"Orchestrator reserve — 30–40%:"})," held for strategic oversight, synthesizing agent outputs, and interacting with the user. This never gets spent on execution work."]}),"\n",n(a.li,{children:[t(a.strong,{children:"Agent summaries — 20–30%:"})," accumulated results from completed agents. As work finishes, the orchestrator retains structured summaries — what was done, what was decided, what files were changed — not the full output."]}),"\n",n(a.li,{children:[t(a.strong,{children:"Current task — 20–30%:"})," the active agent's working context. The specialist gets what it needs; the orchestrator doesn't carry this weight."]}),"\n",n(a.li,{children:[t(a.strong,{children:"Overflow buffer — 10%:"})," reserved for unexpected scope, clarification loops, or edge cases that appear mid-workflow."]}),"\n"]}),"\n",t(a.p,{children:"When a task would consume more than 5% of the orchestrator's reserve — reading code, writing implementations, running build commands — Zoe delegates it to a specialist. The orchestrator stays at the strategic level, holding sequencing, dependencies, and cross-cutting decisions, just as a team lead does when execution work is running in parallel below them. The budget model isn't a constraint on what Zoe can do — it's what makes Zoe capable of managing complex, multi-stage work without losing coherence as the workflow grows."}),"\n",t(a.p,{children:"Zoe also implements a Skill-First Protocol: before any session begins doing ad hoc work, it checks whether a skill — a workflow program encoding how to handle a class of tasks — already exists for what's being asked. This is context engineering at the meta level. The skill doesn't just describe what to do; it encodes the information routing logic that makes it work. Which agents receive which context, in which order, with which framing. That knowledge lives in the skill, not in the session."}),"\n",t(a.h2,{children:"Parallel Context Distribution: Same Input, Different Frames"}),"\n",t(a.p,{children:"One of the more powerful context engineering patterns is parallel context distribution — giving multiple agents the same raw input but framing the context differently for each one based on its domain."}),"\n",t(a.p,{children:"When Zoe kicks off a new project, the project-ideation skill launches three agents simultaneously. The research-analyst receives a product discovery frame: user personas, key journeys, success metrics, competitive landscape. The technical-analyst receives a feasibility frame: stack compatibility, infrastructure requirements, integration complexity, technical risks. The ux-designer receives a complexity frame: screen inventory, user flows, accessibility targets, mobile platform constraints. Same raw idea from the user. Three distinct context frames. Three specialized outputs that compose into a complete picture."}),"\n",t(a.p,{children:"This is what separates context engineering from prompt engineering. We didn't write a smarter prompt. We designed an information flow. Each agent receives exactly the context that makes it productive in its domain, and nothing that distracts from that domain. The outputs arrive faster than any single agent could produce them — and they're better, because each agent is reasoning from a focused frame rather than a sprawling one."}),"\n",t(a.p,{children:"Phase 2 of that workflow makes the accumulation explicit: the architect agent receives the synthesized outputs from all three — the research analysis, the technical analysis, the UX discovery document. It doesn't rebuild what those agents found. The context has been accumulated, organized, and handed forward. Each phase inherits from the previous one without restarting."}),"\n",t(a.h2,{children:"Sequential Context Accumulation: The Compounding Chain"}),"\n",t(a.p,{children:"Sequential workflows reveal a different pattern: context that compounds through a chain of agents, each one building on what the previous agent established."}),"\n",t(a.p,{children:"Zoe's dev-workflow skill starts not with implementation but with a context-building pass. Before the sprint-programmer writes a single line of code, a technical-analyst produces a Story Context Block — a structured summary of the current codebase state, relevant file paths, architectural constraints, and infrastructure reality that applies to the story being implemented. This artifact exists for one reason: to prime the sprint-programmer with what it needs to make the right implementation choices on the first pass, rather than discovering architectural realities mid-stream and having to backtrack."}),"\n",t(a.p,{children:"The sprint-context.md file carries that context forward through the entire sprint. It's warm memory — persisted between agent invocations — so every agent in the sprint inherits the decisions of previous agents without having to rediscover them. When the code-reviewer analyzes the implementation, it already knows the architectural constraints that shaped it. When the pre-commit-validator runs, it doesn't need the full design rationale — it only needs the diff and the validation rules."}),"\n",t(a.p,{children:"This last point is critical. The pre-commit-validator receiving the full product reasoning would be waste. It would consume context budget on information that doesn't change what the validator needs to do. Narrow context isn't a limitation on the agent — it's what makes the agent precise. Agent specialization enforced through context scoping is how you turn a chain of agents into a chain of experts rather than a chain of generalists each trying to remember everything."}),"\n",t(a.h2,{children:"The Harness Is the Product"}),"\n",t(a.p,{children:"Here's the insight most teams miss: the workflows that route context through a multi-agent system aren't infrastructure beneath your AI application. They are the application."}),"\n",t(a.p,{children:"Zoe's orchestration skill, project-ideation skill, and dev-workflow skill aren't prompts that have been refined over time. They're workflow programs — structured specifications of what gets passed to whom, in what order, with what framing, and what gets preserved for downstream agents. When you look at Zoe's MEMORY.md, hot.md, and sprint-context.md files, you're looking at context engineering artifacts: carefully designed injection points that prime agents with exactly the knowledge they need at exactly the moment they need it."}),"\n",t(a.p,{children:"Every one of those design decisions — what to store in warm memory versus cold archive, which agents run in parallel versus sequence, how much context to give the orchestrator versus delegate to specialists — is a context engineering decision. And the quality of your production AI system is determined more by those decisions than by any individual prompt."}),"\n",t(a.p,{children:"The teams that will pull ahead aren't the ones with the cleverest prompts. They're the ones that have stopped treating AI as a chatbot they're prompting and started treating it as a system they're architecting — where the most important engineering decisions concern what each agent knows, when it knows it, and how that knowledge compounds through the workflow."}),"\n",n(a.p,{children:["If you're hitting the ceiling of prompt engineering and want to talk through what a context-engineered architecture would look like for your stack, ",t(a.a,{href:"/work-with-us",children:"reach out to us"}),". This is the work we're doing at BrinsCorp, and it's the work we help companies bring to production."]})]})}return{default:function(e={}){const{wrapper:n}=e.components||{};return n?t(n,{...e,children:t(_createMdxContent,{...e})}):_createMdxContent(e)}};

AI & Automation

Categories

Pulled Offline: What the Fable 5 Ban Reveals About the Coming AI Access Divide

Context Engineering at Station One: How the Technical Analyst Grounds the Entire Conveyor Belt

The Dev-Workflow Conveyor Belt: Multi-Agent Orchestration Inside the Harness

Agentic Minds, Defined Boundaries: Why Security Belongs in Your AI Harness From Day One

The AI Agent Harness: Why Every Industry Needs One

Why Context Engineering Beats Prompt Engineering for Production AI

Stay Ahead of the Curve