--- title: The Complete Guide to Agent Harnesses (With Code) description: A practical breakdown of what an 'agent harness' actually is: the code layer wrapping a tiny LLM tool-calling loop that determines what an AI agent can do,... canonical: https://daily.dev/posts/the-complete-guide-to-agent-harnesses-with-code--wlssc2kw2 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Complete Guide to Agent Harnesses (With Code) | daily.dev og:description: A practical breakdown of what an 'agent harness' actually is: the code layer wrapping a tiny LLM tool-calling loop that determines what an AI agent can do,... og:url: https://daily.dev/posts/the-complete-guide-to-agent-harnesses-with-code--wlssc2kw2 og:image: https://api.daily.dev/og/posts/wLsSC2kw2.png og:image:alt: The Complete Guide to Agent Harnesses (With Code) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Complete Guide to Agent Harnesses (With Code) **[Medium](https://daily.dev/sources/medium_js)** · 17 min read · 0 upvotes · 0 comments ## Summary A practical breakdown of what an 'agent harness' actually is: the code layer wrapping a tiny LLM tool-calling loop that determines what an AI agent can do, reach, remember, have checked, and see. Covers five enforceable layers with code examples: execution boundaries (hooks that deny tool calls before dispatch), sandboxing (path resolution before allowlist checks, since deny lists can be bypassed with symlinks or '../'), memory persistence (deciding what lives in conversation, disk, or config), verification loops (read-only reviewers and dry-run defaults), and context pipelines (subagent delegation to cut token costs). Cites a June 2026 preprint showing harnesses cause up to 40x differences in token cost per solved task but only 0-8 percentage points difference in pass rate, meaning harnesses control cost far more than capability. Also surveys several caveats: none of the cited studies are peer-reviewed, harness optimization gains often fail to generalize to new tasks, fine-tuning results can be scored against their own training reward signal, harnesses built post-training don't transfer well, the industry lacks a consistent definition of 'harness', and harness effects may shrink as base models improve. Includes a companion GitHub repo with runnable scripts demonstrating each layer with and without guards. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Does the agent harness matter more than the choice of model? For cost, yes; for capability, not much. A study running Goose, OpenCode, and OpenHands-SDK across two models on a 50-task Terminal-Bench Pro subset found up to a 40x difference in tokens per solved task between harnesses, while pass-rate differences were only 0 to 8 percentage points with confidence intervals crossing zero. Upgrading the model itself moved pass rate by only 1.0 to 1.3x. _Weighing cost versus capability tradeoffs in agent tooling is easier with sourced comparisons on daily.dev._ ### Why doesn't a rule like 'never delete a file without asking' written in a system prompt actually stop an AI agent from deleting files? Because a system prompt rule is only a bet that the model remembers and follows it under context pressure, and it runs on nothing at execution time. One documented case had the agent read the rule at the start of every session yet still delete a protected file, since the check never ran between the model's decision and the tool call. Enforcing the same rule as a code hook that runs before the tool call and can return a deny fixes the gap. _Developers hardening agent workflows against silent rule violations can track patterns like this on daily.dev._ ### Why can a deny-list based file sandbox for an AI agent still leak a file it was supposed to block? Because the deny-list check runs on the raw path string the agent typed, before path normalization collapses sequences like '../' — so 'work/../secrets/api_key' passes the check even though it resolves to the same blocked file as 'secrets/api_key'. The fix is resolving the path first with something like os.path.normpath, then comparing against an allowlist of permitted roots rather than a denylist of forbidden ones. _Teams sandboxing agent file access can compare enforcement techniques like this on daily.dev before shipping._ --- Tags: [#python](https://daily.dev/tags/python), [#llm](https://daily.dev/tags/llm), [#ai-agents](https://daily.dev/tags/ai-agents) [View this post on daily.dev](https://daily.dev/posts/the-complete-guide-to-agent-harnesses-with-code--wlssc2kw2) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Complete Guide to Agent Harnesses (With Code)","url":"https://daily.dev/posts/the-complete-guide-to-agent-harnesses-with-code--wlssc2kw2","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-complete-guide-to-agent-harnesses-with-code--wlssc2kw2"},"datePublished":"2026-08-23T17:13:29.932Z","dateModified":"2026-09-14T06:44:06.853Z","description":"A practical breakdown of what an 'agent harness' actually is: the code layer wrapping a tiny LLM tool-calling loop that determines what an AI agent can do,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c8e62950eb7f530bca93c5cdd3ba6c00?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c8e62950eb7f530bca93c5cdd3ba6c00?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-complete-guide-to-agent-harnesses-with-code--wlssc2kw2","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"python,llm,ai-agents","timeRequired":"PT17M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"The Complete Guide to Agent Harnesses (With Code)"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-complete-guide-to-agent-harnesses-with-code--wlssc2kw2#faq","mainEntity":[{"@type":"Question","name":"Does the agent harness matter more than the choice of model?","acceptedAnswer":{"@type":"Answer","text":"For cost, yes; for capability, not much. A study running Goose, OpenCode, and OpenHands-SDK across two models on a 50-task Terminal-Bench Pro subset found up to a 40x difference in tokens per solved task between harnesses, while pass-rate differences were only 0 to 8 percentage points with confidence intervals crossing zero. Upgrading the model itself moved pass rate by only 1.0 to 1.3x. Weighing cost versus capability tradeoffs in agent tooling is easier with sourced comparisons on daily.dev."}},{"@type":"Question","name":"Why doesn't a rule like 'never delete a file without asking' written in a system prompt actually stop an AI agent from deleting files?","acceptedAnswer":{"@type":"Answer","text":"Because a system prompt rule is only a bet that the model remembers and follows it under context pressure, and it runs on nothing at execution time. One documented case had the agent read the rule at the start of every session yet still delete a protected file, since the check never ran between the model's decision and the tool call. Enforcing the same rule as a code hook that runs before the tool call and can return a deny fixes the gap. Developers hardening agent workflows against silent rule violations can track patterns like this on daily.dev."}},{"@type":"Question","name":"Why can a deny-list based file sandbox for an AI agent still leak a file it was supposed to block?","acceptedAnswer":{"@type":"Answer","text":"Because the deny-list check runs on the raw path string the agent typed, before path normalization collapses sequences like '../' — so 'work/../secrets/api_key' passes the check even though it resolves to the same blocked file as 'secrets/api_key'. The fix is resolving the path first with something like os.path.normpath, then comparing against an allowlist of permitted roots rather than a denylist of forbidden ones. Teams sandboxing agent file access can compare enforcement techniques like this on daily.dev before shipping."}}]} ```