--- title: Your AI agent is only as good as the harness around it description: Building production-ready AI agents requires far more than a good model — it requires a harness: tool contracts with schemas, timeouts and error taxonomies;... canonical: https://daily.dev/posts/your-ai-agent-is-only-as-good-as-the-harness-around-it-xm4dm2ygc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Your AI agent is only as good as the harness around it | daily.dev og:description: Building production-ready AI agents requires far more than a good model — it requires a harness: tool contracts with schemas, timeouts and error taxonomies;... og:url: https://daily.dev/posts/your-ai-agent-is-only-as-good-as-the-harness-around-it-xm4dm2ygc og:image: https://api.daily.dev/og/posts/XM4dM2YgC.png og:image:alt: Your AI agent is only as good as the harness around it og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Your AI agent is only as good as the harness around it **[The New Stack](https://daily.dev/sources/newstack)** · 12 min read · 0 upvotes · 0 comments ## Summary Building production-ready AI agents requires far more than a good model — it requires a harness: tool contracts with schemas, timeouts and error taxonomies; permission boundaries enforced outside the model; deliberately constructed context with provenance tracking; detailed traces of every model and tool call; and test suites built from real user failures. The piece walks through a billing-agent example showing idempotency keys, read/write tool separation, confirmation gates, and OpenTelemetry-style traces, arguing that permissions act as the real defense against prompt injection since models can't reliably resist embedded instructions. It closes with a sponsored pitch for Oracle AI Database's combined vector search and row-level access control, and the langchain-oracledb/langgraph-oracledb packages that route retrieval and agent memory through that permission model. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How should I design error responses for AI agent tools so the model handles failures correctly? Split tool errors into retryable and terminal categories rather than generic codes. Retryable errors like RATE_LIMITED or UPSTREAM_TIMEOUT tell the agent it can safely retry, while terminal errors like QUOTE_EXPIRED, APPROVAL_REQUIRED, or ACCOUNT_NOT_FOUND stop it from repeating an invalid action. A message like APPROVAL_REQUIRED: annual plan changes need human sign-off gives the model exact next steps, unlike an opaque code such as ERR_422. _daily.dev surfaces practical patterns like this for developers designing reliable tool interfaces for AI agents._ ### How do I prevent an AI agent from being manipulated by prompt injection in support tickets or documents it reads? Scope each tool's credentials tightly rather than relying on the model to resist malicious instructions embedded in data, since you cannot count on it to refuse every injected command. Give each tool its own service identity with minimal access, and pass the user's identity as a verified token the tool checks rather than a parameter the model fills in, so a successful injection has limited blast radius. _Developers securing agent permission boundaries against prompt injection can track these patterns on daily.dev._ ### What should an AI agent trace log capture for auditing a production action like a billing change? A useful trace records the full sequence: the user request, the context used (including policy version and verified scope), each tool call with inputs and outputs, the user's confirmation, the permission check result, and the final tool call outcome with timing, token count, and cost. OpenTelemetry's generative AI conventions already define spans for model and tool calls that many agent frameworks can emit, giving teams a reproducible record instead of a shrug when something goes wrong months later. _Teams building auditable agent systems can follow tracing practices like this via daily.dev._ ## Similar posts on daily.dev - [The Production Harness for AI-Built Apps](https://daily.dev/posts/the-production-harness-for-ai-built-apps-hrpwvderb) · Daily Dose of Data Science \| Avi Chawla \| Substack · 1 upvotes · 0 comments - [When do AI agents need permission boundaries?](https://daily.dev/posts/when-do-ai-agents-need-permission-boundaries--uq6dfetfy) · The New Stack · 2 upvotes · 0 comments - [What It Takes To Scale AI Agents in Production](https://daily.dev/posts/what-it-takes-to-scale-ai-agents-in-production-rombpft2h) · The New Stack · 1 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#observability](https://daily.dev/tags/observability), [#oracle](https://daily.dev/tags/oracle), [#langchain](https://daily.dev/tags/langchain), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/your-ai-agent-is-only-as-good-as-the-harness-around-it-xm4dm2ygc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Your AI agent is only as good as the harness around it","url":"https://daily.dev/posts/your-ai-agent-is-only-as-good-as-the-harness-around-it-xm4dm2ygc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/your-ai-agent-is-only-as-good-as-the-harness-around-it-xm4dm2ygc"},"datePublished":"2026-08-30T15:01:11.983Z","dateModified":"2026-08-31T13:01:58.345Z","description":"Building production-ready AI agents requires far more than a good model — it requires a harness: tool contracts with schemas, timeouts and error taxonomies;...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/61d593580f3175d59227389135220c64?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/61d593580f3175d59227389135220c64?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The New Stack","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The New Stack","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/newstack","url":"https://daily.dev/sources/newstack"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/your-ai-agent-is-only-as-good-as-the-harness-around-it-xm4dm2ygc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,observability,oracle,langchain,prompt-injection","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The New Stack","item":"https://daily.dev/sources/newstack"},{"@type":"ListItem","position":3,"name":"Your AI agent is only as good as the harness around it"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/your-ai-agent-is-only-as-good-as-the-harness-around-it-xm4dm2ygc#faq","mainEntity":[{"@type":"Question","name":"How should I design error responses for AI agent tools so the model handles failures correctly?","acceptedAnswer":{"@type":"Answer","text":"Split tool errors into retryable and terminal categories rather than generic codes. Retryable errors like RATE_LIMITED or UPSTREAM_TIMEOUT tell the agent it can safely retry, while terminal errors like QUOTE_EXPIRED, APPROVAL_REQUIRED, or ACCOUNT_NOT_FOUND stop it from repeating an invalid action. A message like APPROVAL_REQUIRED: annual plan changes need human sign-off gives the model exact next steps, unlike an opaque code such as ERR_422. daily.dev surfaces practical patterns like this for developers designing reliable tool interfaces for AI agents."}},{"@type":"Question","name":"How do I prevent an AI agent from being manipulated by prompt injection in support tickets or documents it reads?","acceptedAnswer":{"@type":"Answer","text":"Scope each tool's credentials tightly rather than relying on the model to resist malicious instructions embedded in data, since you cannot count on it to refuse every injected command. Give each tool its own service identity with minimal access, and pass the user's identity as a verified token the tool checks rather than a parameter the model fills in, so a successful injection has limited blast radius. Developers securing agent permission boundaries against prompt injection can track these patterns on daily.dev."}},{"@type":"Question","name":"What should an AI agent trace log capture for auditing a production action like a billing change?","acceptedAnswer":{"@type":"Answer","text":"A useful trace records the full sequence: the user request, the context used (including policy version and verified scope), each tool call with inputs and outputs, the user's confirmation, the permission check result, and the final tool call outcome with timing, token count, and cost. OpenTelemetry's generative AI conventions already define spans for model and tool calls that many agent frameworks can emit, giving teams a reproducible record instead of a shrug when something goes wrong months later. Teams building auditable agent systems can follow tracing practices like this via daily.dev."}}]} ```