Your AI model is not your production system

When an AI pilot stalls, the reflex is always the same: the model is not good enough. We wait for the next version, reopen the comparisons, relaunch a vendor selection process.

It is almost always the wrong investment.

On February 11, 2026, OpenAI published an internal retrospective that reframes the issue. Three engineers, five months, around 1,500 integration requests, roughly one million lines of code, and not a single line written by hand: all of it produced by agents. The striking figure is not the interesting part. The interesting part is what the team says it did every time something failed. Never “let’s ask better.” Always: what capability is missing, and how can we make it legible and enforceable for the agent? They gave a name to the object they had been building without intending to: the harness.

The shift that 2026 made visible

Three years, three successive disciplines. 2024 was the art of prompting: asking well. 2025 was the art of context: feeding well. 2026 is the art of the execution system: governing well.

In March 2026, LangChain articulated the equation that has since circulated through technical teams: an agent is a model plus a harness. The harness is everything that is not the model: state retained between steps, tool execution, feedback loops, constraints that can actually be enforced. A raw model is not an agent; it becomes one when a harness gives it memory, tools, verification and limits.

The analogy works well in the boardroom: the model is the engine; the harness is the car. A racing engine fitted to a chassis with no brakes or steering does not make a fast car. It makes a fast accident.

The evidence, and its limitation, stated together

The claim would be hollow without measurement. A study published on arXiv in April 2026 (Agentic Harness Engineering, reference 2604.25850) ran the clean experiment: keep the model unchanged and evolve only the harness—that is, the tools, middleware layers and memory. On the Terminal-Bench 2 benchmark, the success rate rises from 69.7% to 77.0% in ten iterations, surpassing in the process the human-designed reference harness, at 71.9%.

Let us say immediately what this figure does not tell us. It concerns coding agents, on a specific benchmark, and the authors themselves limit the scope of transfer to the domains and model families tested. We are not extrapolating it to your back office, and nobody should.

What it establishes is more modest and more useful: with the model held constant, engineering the surrounding system moves the outcome by several points. It does not prove a gain in your organisation. It is more than enough to change the order of budget priorities, because the investment in question is not the same. Changing models is a purchase. Building a harness is a capability that stays in-house and survives the next model.

The four boundaries

The previous article in this series raised the question of accountability: who specifies, who verifies, who approves. This one raises the complementary question, that of the system: what does execution permit? Four boundaries, and one shared requirement.

1. What the agent can see. Which data, which systems, under which identity. Not “it has access to the CRM,” but what scope, with what filtering, logged where.

2. What it can do. The list of actions, separated between those that can be undone and those that cannot. Sending a message, changing a record, and committing a payment are not the same risk class and should not share the same authorisation regime.

3. How its work is verified. This is the most poorly handled boundary, and Thoughtworks provides the right grammar in its April 2026 work: guides direct the agent before it acts; sensors observe the outcome afterwards and enable it to correct itself. Each can be deterministic—a test or rule that passes or fails—or inferential—another model making a judgement. Our position is firm: for anything that commits the company toward a client, regulator or third party, there must be at least one deterministic control. An inferential judgement is a fast opinion; it is not proof.

4. Who is accountable when things go wrong. A threshold, a named person, a stop right that can be exercised by someone who did not build the system.

The shared requirement is the only thing that really matters: every boundary must be executable. Verifiable by a machine, or enforceable through a log. A boundary that lives in an intent statement is not a boundary; it is an intent statement with a paragraph number.

What this changes for an executive committee

Deloitte, in its Tech Trends 2026 edition, provides the snapshot: 11% of organisations have agents in production, while 38% are still at the pilot stage, and 35% have no agentic strategy. This is not a failure rate, and we should resist the temptation to read it that way: it is a maturity distribution, and it mainly shows where almost everyone stands—on the step between pilot and production. The same work also finds that only 21% of surveyed executives report a mature governance model for agentic AI, based on 3,235 IT and business leaders across 24 countries.

The gap between 38 and 11 is precisely the harness.

On a Tuesday in September, two risk functions within the same banking group launch a case-processing agent, using the same model and the same vendor. The first opens broad access “so as not to constrain testing” and verifies by sampling at month-end. The second writes the four boundaries before the first request: data scope restricted to portfolio files, financial-commitment actions prohibited, deterministic control over every amount and customer reference, named escalation beyond a threshold. Six weeks later, the first has an incident to assess and a case file to reconstruct. The second has an error measure—and therefore an extension decision to make. Same model. Two execution systems.

You do not choose a model; you build an execution system. The model changes every quarter; the harness belongs to you.

Four questions for your next executive committee

1. For our most advanced agent, does the list of what it can see and what it can do exist anywhere other than in the head of the person who configured it?
2. Among its actions, which are irreversible, and do they follow a distinct authorisation regime?
3. What proportion of our verification is deterministic, and what proportion relies on the judgement of another model?
4. Who can stop it without asking permission from the team that built it?

If all four answers fit in a note rather than in a configuration, you do not yet have a production system. You have a pilot with good results.

The work of 2026 is not to buy a better model. They will arrive anyway, faster than your budget cycles, and your advantage will not last any longer than that of your competitor using the same vendor. The work is to build, around these models, an execution system bounded enough to be entrusted to agents and traceable enough to be defended before a board. That is what we move from pilot to governed production for our clients, and what we apply to our own products, starting with RegRadar by TokenShift.

A candid question: in your organisation, is the reliability of your agents a property of the model you bought, or of the system you built?

This series continues through to our September executive committee campaign. Follow the Page for what comes next.

Sources:

• OpenAI, Harness engineering: leveraging Codex in an agent-first world, February 11, 2026.
• LangChain, The Anatomy of an Agent Harness, March 2026.
• Thoughtworks, Harness engineering and agent feedback: exploring AI coding sensors, and Technology Radar volume 34, April 2026.
• Agentic Harness Engineering: Observability-Driven Automatic Evolution of Coding-Agent Harnesses, arXiv 2604.25850, April 2026.
• Deloitte, Tech Trends 2026, and associated agentic survey (3,235 IT and business leaders, 24 countries).

#AIGovernance #EnterpriseAI #ExecutiveCommittee #ProductionDeployment