--- title: Toward a Four-Layer Architecture for Self-Hosted... description: A reference architecture for self-hosted enterprise AI harnesses is proposed, organized into four functional layers: Input, Agent Loop (ReAct), Execution, and... canonical: https://daily.dev/posts/toward-a-four-layer-architecture-for-self-hosted-enterprise-ai-harnesses-ntrsklg4p twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Toward a Four-Layer Architecture for Self-Hosted Enterprise AI Harnesses | daily.dev og:description: A reference architecture for self-hosted enterprise AI harnesses is proposed, organized into four functional layers: Input, Agent Loop (ReAct), Execution, and... og:url: https://daily.dev/posts/toward-a-four-layer-architecture-for-self-hosted-enterprise-ai-harnesses-ntrsklg4p og:image: https://api.daily.dev/og/posts/nTRskLG4P.png og:image:alt: Toward a Four-Layer Architecture for Self-Hosted Enterprise AI Harnesses og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Toward a Four-Layer Architecture for Self-Hosted Enterprise AI Harnesses **[Medium](https://daily.dev/sources/medium_js)** · 9 min read · 2 upvotes · 0 comments ## Summary A reference architecture for self-hosted enterprise AI harnesses is proposed, organized into four functional layers: Input, Agent Loop (ReAct), Execution, and Identity/Policy/Audit. The core argument is that the hard problem in enterprise AI is not choosing components but defining the right architectural boundaries between them. The architecture runs on Kubernetes and uses concrete open-source implementations (Keycloak, Vault, agentgateway, kagent, OTEL) to validate the boundaries. Key concerns like multi-tenancy and data isolation are treated as cross-cutting concerns, while environment (Dev/Test/Prod) is pushed outside the harness into infrastructure. A concrete end-to-end example traces a single engineering task across all four layers to illustrate how identity, policy, execution, and audit interact. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the difference between skills and tools in an AI agent architecture? Skills are pod-local capability injection, delivered as OCI images containing SKILL.md and supporting scripts mounted into the agent pod at startup, with only skill metadata entering the prompt path and full details loaded lazily when used. Tools instead live in the runtime network and expose external capabilities such as MCP servers, n8n workflows, or LLM providers, accessed through controlled boundaries rather than being part of the agent's own image lifecycle. _daily.dev surfaces architecture write-ups like this for engineers designing agent runtime boundaries._ ### How does Anthropic define a harness for AI agents in Claude Managed Agents? A harness is the runtime environment around an agent, split into four core concepts: Agent (everything defining behavior, not just the model), Environment (the runtime where execution happens), Session (a working instance of the agent in an environment), and Events (messages exchanged between the application and agent). It keeps session, model, and sandbox separated with credentials outside the agent's direct reach, treating safety as a system property. _track how agent harness concepts evolve on daily.dev before committing to a self-hosted design._ ### How can short-lived credentials be managed for AI agents accessing secrets in a Kubernetes deployment? Credentials should be issued as short-lived, TTL-bound tokens with automatic revocation rather than giving agents permanent access to secrets, using a broker like Vault with per-tenant secret paths. The agent itself never sees secrets directly; access is granted temporarily through the secret broker and then revoked, keeping reasoning, execution, and privileged access cleanly separated. _developers securing agent-to-secret access can follow this kind of guidance on daily.dev._ ## Similar posts on daily.dev - [Enterprise AI Architecture From Pilot to Production](https://daily.dev/posts/enterprise-ai-architecture-from-pilot-to-production-bzcljsbkm) · portkey · 0 upvotes · 0 comments - [The 8 Layer Engineering Behind a Production AI Systems](https://daily.dev/posts/the-8-layer-engineering-behind-a-production-ai-systems-pimdncv7f) · Daily Dose of Data Science \| Avi Chawla \| Substack · 1 upvotes · 0 comments - [From Prototype to Production: The Architecture Behind Secure & Governed AI Agents](https://daily.dev/posts/from-prototype-to-production-the-architecture-behind-secure-governed-ai-agents-lciugqfyu) · Towards Data Science · 0 upvotes · 0 comments - [How AI-native systems are built](https://daily.dev/posts/how-ai-native-systems-are-built-vohfc13cf) · The New Stack · 3 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#ai-agents](https://daily.dev/tags/ai-agents), [#architecture](https://daily.dev/tags/architecture), [#mcp](https://daily.dev/tags/mcp), [#multi-tenancy](https://daily.dev/tags/multi-tenancy) [View this post on daily.dev](https://daily.dev/posts/toward-a-four-layer-architecture-for-self-hosted-enterprise-ai-harnesses-ntrsklg4p) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Toward a Four-Layer Architecture for Self-Hosted Enterprise AI Harnesses","url":"https://daily.dev/posts/toward-a-four-layer-architecture-for-self-hosted-enterprise-ai-harnesses-ntrsklg4p","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/toward-a-four-layer-architecture-for-self-hosted-enterprise-ai-harnesses-ntrsklg4p"},"datePublished":"2026-07-17T19:33:50.647Z","dateModified":"2026-09-14T06:50:41.404Z","description":"A reference architecture for self-hosted enterprise AI harnesses is proposed, organized into four functional layers: Input, Agent Loop (ReAct), Execution, and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/eb0daa19e278fb5308c2cabed2684757?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/eb0daa19e278fb5308c2cabed2684757?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/toward-a-four-layer-architecture-for-self-hosted-enterprise-ai-harnesses-ntrsklg4p","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,ai-agents,architecture,mcp,multi-tenancy","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"Toward a Four-Layer Architecture for Self-Hosted Enterprise AI Harnesses"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/toward-a-four-layer-architecture-for-self-hosted-enterprise-ai-harnesses-ntrsklg4p#faq","mainEntity":[{"@type":"Question","name":"What is the difference between skills and tools in an AI agent architecture?","acceptedAnswer":{"@type":"Answer","text":"Skills are pod-local capability injection, delivered as OCI images containing SKILL.md and supporting scripts mounted into the agent pod at startup, with only skill metadata entering the prompt path and full details loaded lazily when used. Tools instead live in the runtime network and expose external capabilities such as MCP servers, n8n workflows, or LLM providers, accessed through controlled boundaries rather than being part of the agent's own image lifecycle. daily.dev surfaces architecture write-ups like this for engineers designing agent runtime boundaries."}},{"@type":"Question","name":"How does Anthropic define a harness for AI agents in Claude Managed Agents?","acceptedAnswer":{"@type":"Answer","text":"A harness is the runtime environment around an agent, split into four core concepts: Agent (everything defining behavior, not just the model), Environment (the runtime where execution happens), Session (a working instance of the agent in an environment), and Events (messages exchanged between the application and agent). It keeps session, model, and sandbox separated with credentials outside the agent's direct reach, treating safety as a system property. track how agent harness concepts evolve on daily.dev before committing to a self-hosted design."}},{"@type":"Question","name":"How can short-lived credentials be managed for AI agents accessing secrets in a Kubernetes deployment?","acceptedAnswer":{"@type":"Answer","text":"Credentials should be issued as short-lived, TTL-bound tokens with automatic revocation rather than giving agents permanent access to secrets, using a broker like Vault with per-tenant secret paths. The agent itself never sees secrets directly; access is granted temporarily through the secret broker and then revoked, keeping reasoning, execution, and privileged access cleanly separated. developers securing agent-to-secret access can follow this kind of guidance on daily.dev."}}]} ```