OPENXEL Agents · agent harnessing

Agent harnessing: keeping an agent inside its job

Bought by VP Engineering and Platform. An agent that calls tools is a new class of principal, and most estates hand it a service account and hope.

The failure

What goes wrong here

An agent that calls tools is a new class of principal. It holds credentials, it takes actions, and the actions are not always reversible.

Most estates hand it a service account and hope. There is no authority model, no least privilege on tool access, and no answer for a prompt that is itself the attack.

What we build

  • Agent design scoped to one job with a stated boundary
  • A tool and authority model that says what it may reach and who approved that
  • An evaluation harness that runs before every change
  • A named human checkpoint on anything irreversible
  • Replay from inputs, so a run can be reconstructed rather than guessed at
An authority model for an agent that calls tools An agent sits at the centre. On the left, the approver: a named person and a date. On the right, the enumerated tool list, each grant marked allowed, behind a human checkpoint, or denied. Anything irreversible sits behind a named checkpoint. approved by A named person and the date they signed The agent scoped to one job the tool list — enumerated, not a role ✓ crm.read ✓ ledger.read ! ledger.write · checkpoint ✕ email.send · denied ✕ admin.* · denied Irreversible actions named human checkpoint A role is a promise about a set that changes without anyone re-reading it. The list is the control.
An authority model. The enumerated tool list, the grant per tool, the person who approved it, and a named checkpoint in front of anything irreversible.
The artifact

What you keep

An authority model and an evaluation harness, both versioned in your repository.

Adjacency

What ships beside it

An authority model is an agent decision and a security decision at the same time. One engagement, one boundary. See security engineering.

Send us the problem

Describe what is stuck. We will come back with an architecture, a timeline and the first commit.

Send us the problem See the six-step path