Agent Harness: how AI agents work and why security must be deterministic

Artificial intelligence is going through an important transformation: we are moving from systems that can answer questions to systems that can perform actions.

This is the shift from generative AI to Agentic AI, a paradigm in which agents can interact with applications, retrieve information, use tools and carry out even complex tasks.

But what turns a Large Language Model (LLM) into a real AI agent? And above all, how can we ensure that these systems operate within company rules and permissions?

The answer runs through a fundamental concept: the Agent Harness.

What is an Agent Harness?

An AI agent is not simply a language model to which we have assigned a few instructions.

It is a software system made of several elements that work together to let the model interpret requests, make operational decisions and use tools.

The set of components that orchestrate and govern this behaviour is commonly called the Agent Harness.

We can identify five fundamental elements:

1. Model (LLM): the AI engine that interprets context, processes requests and identifies the actions to take.
2. Instructions: they define the agent's role, goals, expected behaviour and interaction patterns.
3. Knowledge and context: the information made available to the agent to carry out its tasks.
4. Tools: they let the agent interact with external systems, applications, APIs and workflows.
5. Controls and security: they govern the allowed operations, permissions and any required authorisations.

The model is therefore only one part of the architecture. An agent's ability to produce value also depends on the tools available and on the rules that govern their use.

Tools: when AI starts to act

The most significant difference between a traditional chatbot and an operational AI agent is the ability to use tools.

Through these tools, an agent can:

• Query information in a CRM or an ERP.
• Read and generate documents, reports and presentations.
• Run web searches.
• Interact with applications through APIs.
• Connect to external services via MCP (Model Context Protocol).
• Trigger automation workflows, for example through n8n.

A tool can be relatively simple, like a function that retrieves a piece of information, or very complex, like a workflow that involves several company systems.

Think of an agent tasked with supporting the administrative office. It could retrieve an invoice, compare it with a purchase order, verify some information and prepare a proposed accounting entry.

The real innovation is not only the model's ability to understand the request, but the possibility of connecting that ability to the company's operational processes. This is the ground we work on with system integration and AI agents and automations.

Company knowledge is not the database

A frequent misunderstanding concerns the concept of the agent's knowledge.

When we talk about knowledge, we do not necessarily mean the entire company database.

An agent can access information through specific interfaces and tools that expose only the data that is necessary and permitted.

For example, an employee could use an AI agent to check their own payslip. This does not mean that the same agent should be able to access other employees' payslips.

The distinction is fundamental. Data access must be governed by authentication, authorisation and privilege separation systems, regardless of the language model's capabilities.

An integration through API or MCP can expose certain functionality, but it must always respect the authorisations defined by the company systems.

Connecting an agent to a system does not mean granting it unrestricted access to all the information it contains.

Probabilistic AI and deterministic software: the real balance

We now reach what is probably the most important aspect of the whole architecture.

Large Language Models are probabilistic systems. They produce answers and select actions based on the context, the instructions and the mechanisms learned during training.

This makes them extremely flexible, but it also introduces behaviours that cannot be guaranteed simply through a prompt.

We can ask an agent not to access certain information or not to perform specific operations. But can we treat these instructions as a security guarantee?

No.

Instructions can be interpreted unexpectedly or manipulated through prompt injection techniques. For this reason, critical controls must be implemented at the software level, through deterministic mechanisms.

In other words:

AI can decide which operation to propose. Software must determine whether that operation is actually allowed.

If an agent only has read permissions, it must not be able to modify data, regardless of the instructions it receives.

If a given operation requires a manager's approval, the system must prevent its execution until that authorisation is obtained.

It must not be the language model that decides whether or not to respect this rule. It is the same principle that drives agentic engineering: tools, guardrails and ownership, not a model with unrestricted access.

Human-in-the-Loop: keeping control over critical operations

Another fundamental principle in designing enterprise AI agents is Human-in-the-Loop.

Not all operations necessarily have to be fully autonomous. Some tasks can be performed without human intervention, while others require verification or approval.

Think, for example, of three levels of operation:

Level 1 · Consultation

The agent can read information and produce analyses, respecting the user's permissions.

Level 2 · Controlled execution

The agent can update data or start processes within preset limits and conditions.

Level 3 · Mandatory approval

The agent can prepare an operation, but its execution requires the explicit authorisation of a person.

An administrative agent could therefore analyse an invoice and propose its accounting entry, while leaving the final confirmation to an authorised operator.

This approach allows you to leverage the capabilities of artificial intelligence without giving up control over the most sensitive processes.

Why the Agent Harness is strategic for companies

When adopting artificial intelligence, a lot of attention goes to choosing the model: which LLM to use, how performant it is or what the cost per token is.

These are important aspects, but they are not enough.

In a business context, an agent's value depends above all on the quality of its integration with existing systems, on the reliability of the tools and on the ability to govern its behaviour.

A properly designed architecture must consider:

• Identity and permission management.
• Separation between read and write.
• Validation of inputs and operations.
• Human approvals when necessary.
• Traceability of the actions performed.
• Monitoring of errors and unexpected behaviour.

These are essential elements to turn an interesting prototype into a solution that can really be used in business processes.

The future of AI agents runs through control, not autonomy alone

The next evolution of artificial intelligence in companies will not be only about increasingly powerful models.

It will be above all about the ability to build systems in which probabilistic intelligence and deterministic software can work together.

On one side, the flexibility of language models in understanding requests, interpreting information and identifying solutions. On the other, the predictability of software systems in guaranteeing permissions, operational constraints and controls.

An AI agent must not only be intelligent. It must be reliable, governable and secure.

It is on this balance that the move from AI experiments to genuinely operational business automation is built.

---

From the workshop on AI Agents for SMEs

These topics were covered during our workshop dedicated to AI Agents for SMEs, organised in collaboration with the Chamber of Commerce of Milano Monza Brianza Lodi, at Palazzo Giureconsulti in Milan.

In the video we explore how the Agent Harness works, the role of tools, the integration with API and MCP and the importance of deterministic controls in AI agent security.

Watch the video and discover how an AI agent works.

Syncronika: AI, Automation and Digital Transformation

At Syncronika we design and build artificial intelligence, automation and software integration solutions to help companies make their processes more efficient, intelligent and controllable.

We start from real processes and existing authorisations, connect systems with integration and APIs and introduce AI agents and automations only where behaviour can be measured and governed.

If you want to understand where an AI agent can generate value in your processes, let's talk. The first question is not which model to choose. It is which operations you really want to allow, and with which controls.