Agent harness design: trade-off analysis

April 19, 2026

An agent harness is the runtime that sits between a language model and the world. It manages the conversation loop, dispatches tool calls, enforces context and trust boundaries, persists session state, and shepherds work across failures. "Agent harness" is not a single pattern; it is a design space with several largely independent axes. Choices on one axis constrain others, and the sharpest failures in production come from the interactions rather than from any single dimension in isolation.

A harness also does not exist in isolation. It depends on, and is co-designed with, a broader ecosystem: identity and delegation systems, storage substrates, proxies and gateways, network policy enforcement, observability pipelines, evaluation infrastructure, model lifecycle tooling, supply-chain controls, policy engines and approval flows, cost and quota systems, long-term memory stores, and compliance mechanisms. A harness that wins on its internal axes but has no eval suite, no policy engine, and no cost ceiling is still a fragile production system.

This is the overview of a series. It organizes the design space around six primitives connected by a small set of contractual touch points. Four of them, the sandbox fabric, the persistence fabric, the identity fabric, and the agent-harness runtime itself, are commonly named across the ecosystem. Two more, a model-access fabric and a governance fabric, are usually smeared across the others; this series argues they are separable and worth naming. Each primitive, and the cross-cutting contracts between them, gets its own deep companion post, linked below. This page carries the framing, the contracts, and the cross-cutting failure analysis that belongs to no single primitive. It is a design reference, not a justification for a specific implementation.

The six-primitive framing

Across E2B, Daytona, Modal, Namespace, Fly, Replit, Anthropic, OpenAI, LangGraph, Google ADK, and the dedicated identity vendors (Okta, Auth0, Keycloak, AWS IAM, GCP IAM, SPIFFE/SPIRE, Cedar, Oso, Permit.io), the ecosystem commonly names four separable primitives: sandbox, persistence, identity, and the harness itself. We argue for two more. Model access (provider-credential custody, routing, attribution, call-site budget) is usually treated as a configuration line on the harness or a feature of an LLM gateway; the model-access companion makes the case that it is a primitive in its own right. Governance (the agent-as-versioned-document registry, capability attenuation, delegation topology, approval placement) is usually folded into identity or the orchestration runtime; the governance companion draws the line. We do not claim the ecosystem has settled on six. We claim these two seams are load-bearing enough to own. Most observable failures happen not inside a primitive but at the contracts between them, which is why the framing is by ownership and touch points.

Identity is a first-class primitive, not a touch point, because it is the substrate on which tenancy, resource ownership, isolation, sharing, and audit attribution are all built. Treating it as a cross-cutting concern rather than a substrate produces the ambient-authority and cross-tenant-bleed failures the companions document.

The six primitives

The full arguments for the two new primitives live in their companions. The short version: each has one clean consumption contract, vendor-neutral implementations, and production failures that cluster at its edge. Latere builds against several of these primitives (Cella for the sandbox, Lux for model access, Topos for governance, Wallfacer for the runtime), but that mapping is an illustration, not the argument; each primitive has to stand up for a reader who has never heard of Latere. The honest, full version, including the primitives where Latere has no separate product and the seams still open, is in Where Latere stands at the end of this page.

Touch points: the contracts between primitives

Touch points are where production platforms actually fail. Each is a contract that crosses a primitive boundary; if it is ambiguous, the failures at that seam are load-bearing.

• Capability request (runtime ↔ sandbox). "Give me an environment matching this spec." Isolation class, resource shape, network policy, bootstrap inputs.
• Durable state (runtime ↔ persistence). Append-event, read-session, snapshot, fork, retention. Session log, workspace, memory, artifacts.
• Identity resolution (every primitive ↔ identity). "Who is this caller, what tenant, what scopes and delegation chain?" Every other contract relies on this one having a correct, auditable answer.
• Completion (runtime ↔ model access). "Complete this, on this budget, attributed to this caller, without handing over the provider key." Routing, version pin, spend ceiling.
• Authority (runtime ↔ governance). "What is this agent allowed to do, whom may it delegate to, and which actions need a person?" Declared by governance, enforced through identity's token scoping.
• Audit event stream (cross-cutting; every primitive emits to the sink). Observability, tamper-evidence, PII handling, compliance. Every event carries an identity attribution.
• Egress and policy (sandbox ↔ external). Network controls, credential injection, domain allowlists.
• Transport (runtime ↔ client). Session events, SSE / WebSocket / webhook, steering.

The companion deep-dives

Each primitive, and the cross-cutting contracts, has a standalone companion that goes deeper than this overview. In bottom-up reading order:

• The sandbox fabric: trust-boundary placement, what isolation does and does not solve, lifecycle and bootstrap determinism, non-bypassable egress, supply-chain governance.
• The persistence fabric: intent versus step logs, workspace and snapshot recovery, branching, artifacts, storage substrate, long-term memory, audit and erasure.
• The identity fabric: the (user, tenant, agent, workload) substrate, authorization options, tenancy models, isolation tiers, sharing, and lifecycle cascades.
• The model-access fabric: credential custody, routing and version-pinning, usage attribution, synchronous budget enforcement, prompt-cache tenancy, lifecycle-artifact routing.
• The execution runtime: agent lifecycle, MCP connections, context management, execution and session modes, scheduling, composition, tool dispatch, interruption.
• The governance fabric: the agent as a versioned document, capability attenuation, delegation topology, approval placement, and why it is not the identity fabric.
• The cross-cutting contracts: concurrency, operational failure modes, transport, observability, and evaluation, the seams that belong to no single primitive.

The rest of this page is the synthesis the companions cannot carry individually: how the primitives connect, which combinations produce the sharpest failures, and when each tends to surface.

graph TB
    classDef harness fill:#d6eaf8,stroke:#2980b9
    classDef persistence fill:#d5f5e3,stroke:#27ae60
    classDef sandbox fill:#fdebd0,stroke:#e67e22
    classDef identity fill:#fadbd8,stroke:#b03a5b
    classDef model fill:#e8daef,stroke:#8e44ad
    classDef gov fill:#fcf3cf,stroke:#b7950b
    classDef human fill:#ffffff,stroke:#000000
    classDef ext fill:#f2f3f4,stroke:#7f8c8d

    H["Human authority"]
    GOV["Governance fabric"]
    R["Agent-harness runtime"]
    SB["Sandbox fabric"]
    P["Persistence fabric"]
    MA["Model-access fabric"]
    ID["Identity fabric"]
    EXT["External world"]
    LLM["Model providers"]

    H -->|"sets boundaries, approves"| GOV
    GOV -->|"declares capabilities"| R
    R -->|"capability request"| SB
    R -->|"durable state"| P
    R -->|"completion, on budget"| MA
    SB -->|"egress / policy"| EXT
    MA -->|"routed call"| LLM
    R -.->|"resolves caller"| ID
    GOV -.->|"attenuation enforced via"| ID
    MA -.->|"attribution"| ID
    P -.->|"owner tag"| ID

    class R harness
    class P persistence
    class SB sandbox
    class ID identity
    class MA model
    class GOV gov
    class H human
    class EXT,LLM ext

Interactions and timeline

The trade-offs are not independent. The sharpest production failures come from interactions among them, and those interactions cross primitive boundaries as often as they stay within one. The diagram above shows the primitives and their contracts; the clusters below are the specific combinations that produce the highest-impact failures, and the timeline after them is when each tends to surface.

The compounding clusters

Five interaction clusters produce the highest-impact failure modes:

1. Crash-recovery chain. Session durability and workspace recovery (the persistence fabric), scheduler recovery (the execution runtime), and sandbox lifecycle (the sandbox fabric) all replay on crash. A non-idempotent tool call at the intersection of any two produces duplicate side effects. Idempotency keys or a step-log layer have to sit on top of all of them.

2. Model-behavior chain. Model capability shifts, swaps, upgrades, and fine-tunes propagate through the model-access fabric into agent lifecycle and compaction quality (the execution runtime) and trajectory-level evaluation (the cross-cutting contracts). Without an eval gate, every change in this chain is a gamble.

3. Trust-and-policy chain. Placement and isolation (the sandbox fabric) set the secret-reachability boundary; the identity fabric resolves who the caller is and what gates access; the governance fabric decides per-action allow, deny, or approve; network policy makes enforcement non-bypassable. Each layer alone is insufficient.

4. Cost-and-observability chain. Runaway cost is detected by observability (the cross-cutting contracts), enforced synchronously at the model-access fabric, attributed by the identity fabric, and constrained by compliance. Systems that wire budgets only to the billing system, or omit tenant attribution on the model call, recreate the five-figure runaway loops on a schedule and cannot say which tenant caused them.

5. Identity-cascade chain. Every identity-owned resource, sessions, workspaces, memory, artifacts, audit records, cost records, must cascade correctly under user deletion, tenant re-parenting, and revocation. A chain that leaks at any node (memory that outlives a deleted user, audit entries without an identity tuple, cost records that cannot be rebilled on re-parenting) is a compliance liability that surfaces on the first data-protection review. The identity fabric and persistence fabric co-own this.

When each bites

gantt
    title When trade-offs tend to surface
    dateFormat X
    axisFormat %s
    todayMarker off

    section Immediate
    §1 Inner-loop latency (placement)                        :active, 0, 2
    §8 Gateway SPOF / scheduling exhaustion                  :active, 0, 2
    §11 Transport ID mapping / reconnect                     :active, 0, 2
    §24 Gateway setup and limits                             :active, 0, 2

    section First incidents
    §3 Mid-turn crash → non-idempotent replay                :crit, 1, 3
    §4 AZ failure → PVC unreachable                          :crit, 1, 3
    §5 Replica restart → MCP reconnect storm                 :crit, 1, 3
    §6 Duplicate commits / tickets                           :crit, 2, 4
    §12 Runaway schedule / replay of side-effectful ticks    :crit, 1, 3
    §13 Tick lock stuck / overlap                            :crit, 1, 3
    §16 Cold-start under load / non-reproducible resume      :crit, 2, 4
    §18 Stale steering / resource leak on hard cancel        :crit, 2, 4
    §22 Ambient authority / token revocation race            :crit, 2, 4
    §25 First enforcement bypass attempt                     :crit, 2, 4
    §29 First compromised package / slopsquat                :crit, 2, 4
    §31 Budget-as-alert (not enforcement), first runaway    :crit, 1, 3

    section Growth phase
    §2 Singleton deploy pain (>3 agent types)                :2, 5
    §9 First adversarial input → prompt injection            :3, 5
    §10 Model swap / deprecation → silent regression         :3, 6
    §14 First multi-agent pipeline conflict                  :3, 5
    §15 First stateful-resource tool introduced              :3, 5
    §17 First bad-turn fork / workspace divergence           :3, 5
    §19 Plugin/authoring portability tax                     :3, 6
    §20 Tool-name collision or schema bloat                  :3, 5
    §21 Artifact lost to workspace TTL race                  :3, 5
    §26 Observability cost / cardinality blowup              :3, 6
    §27 Eval overfitting or missing trajectory replay        :3, 6
    §30 Gate fatigue / gate bypass via prompt injection      :3, 5
    §32 First memory bleed-over or retrieval poisoning       :3, 5

    section Long-term
    §7 Context quality decay (invisible)                     :4, 7
    §23 Storage substrate cost / snapshot bloat              :4, 7
    §28 Fine-tune staleness / vendor lock-in                 :4, 7
    §33 Regulated customer / DPIA / right-to-erasure         :5, 7

Summary table

This is the full catalog of design axes, preserved with its original numbering; each now lives in depth in one of the companions. To jump from an axis to its deep-dive: sandbox-fabric axes are in the sandbox fabric; durable-state axes in the persistence fabric; the identity axis in the identity fabric; model routing, capability, lifecycle, and cost in the model-access fabric; the per-session execution axes in the execution runtime; registry, attenuation, and approval placement in the governance fabric; and concurrency, operational failure modes, transport, observability, and evaluation in the cross-cutting contracts. The Primitive column uses H = harness runtime, P = persistence, S = sandbox, I = identity, T = touch point; hybrid entries list multiple tags.

Runtime-facing design axes

Ecosystem-facing design axes

Where Latere stands

This series is a design reference, not a product pitch, and every primitive has to stand on its own for a reader who has never heard of Latere. But the framing came out of building, so it is worth being concrete and honest about where Latere's own products sit on this map, including where they do not.

• Sandbox fabric: Cella. The most mature piece in the lineup: durable, disposable runtimes that persist when useful and vanish when idle, with every action observable.
• Model-access fabric: Lux. The deliberate bet on the first of the two contested primitives. The series argues model access is usually smeared across the harness; Lux exists to own it as a separate surface, provider-key custody, scoped runtime tokens, per-call attribution and spend limits. Cost-aware routing and version-pinning behind an eval gate are ahead of it, not behind it.
• Governance fabric: Topos. The bet on the second contested primitive: every agent a named, permissioned, recorded document, with authority that only narrows as work is handed down. The runtime allow-ask-block decision and the full agent-as-versioned-document registry are the parts still being built out.
• Execution runtime: Wallfacer. The surface that turns the runtime's pause-and-resume primitive into a product: shape an idea into a plan, hand it to agents, return the work as changes to review, with a person able to step in at every step.
• Evaluation (a cross-cutting contract): Adversarial Review. Adversarial verification as a first-class step rather than an afterthought, the subject of its own post.

Two of the six primitives, the persistence fabric and the identity fabric, Latere runs as internal substrate rather than separately marketed products. They are the least visible and the most assumed, which is exactly the trap the identity companion warns about. And several of the cross-cutting seams the series flags as where production breaks, non-bypassable egress and tool-call governance, a unified identity-attributed audit stream, long-term memory with per-tenant isolation, and supply-chain control over what an agent installs, are open at Latere too. That is not an embarrassment to hide; it is the honest shape of an under-served space. The seams nobody owns yet are the ones this series exists to name, and they are the next things to build.

The six primitives and their contracts are the structure. The human deciding which trade-off to make on each is the point. Why Latere exists makes the broader argument: the most important intelligence in an autonomous system is the one you cannot see, the person who set the boundaries this whole design space exists to encode. Every companion ends where this overview does, with the human kept in authority over the decisions that matter and the machine running at full speed everywhere else.