The Layer Above Every Harness

The guidance has arrived

In September 2026 the Australian Signals Directorate published Agentic AI Harnesses: The layer above the model. It is one of the first government publications to name, as an architectural category, the software layer that connects an AI model to data, tools and systems — and to state plainly that this layer, not the model, is where the security of agentic AI is decided.

Its findings are direct:

“Organisations control the harness, not the LLM.” The model is a replaceable component. The layer above it is where organisational value, governance and investment accumulate, and it will outlast successive generations of models.

“No harness is inherently secure.” Established security practice — least-privilege access, identity and access management, monitoring, human oversight — must be applied to the harness as it would be to any other system connected to enterprise data.

Prompt injection has no reliable fix inside the model. Because a model cannot dependably distinguish authorised instructions from instructions hidden in the content it processes, ASD concludes that mitigations “must instead be applied in the harness, by controlling what an agent can access and what actions it is permitted to perform.”

“Do not rely on model safety controls instead of harness-enforced controls.” Enforcement must be independent of the intelligence being governed.

Everything must be recorded. Prompts, responses, tool invocations, approvals, actions and configuration changes should be captured, protected, retained and independently monitored. The guidance also treats consumption as a security signal: unexpected cost can indicate misuse, runaway agent loops or denial-of-wallet attacks.

For readers of this research path, none of this is new territory. It is the argument of The Control Plane Must Be Yours, made by the Australian Government’s signals-intelligence and cyber-security agency.

One harness is never the whole estate

The guidance describes controls for a harness. Real enterprise estates run many harnesses at once.

A productivity copilot arrives with the office suite. A coding agent arrives with the development toolchain. Agent capabilities appear inside SaaS products the organisation already licenses. Delivery teams build their own. Each of these is a harness in ASD’s terms: it supplies the model’s context, executes its actions, holds its memory and enforces — or fails to enforce — its permissions.

Each harness governs itself. Each is configured separately, by different teams, on different assumptions. Each attests to its own behaviour, and several send telemetry to their vendors by default.

Applying ASD’s controls inside each harness separately therefore produces three structural problems. Policy becomes inconsistent, because it is re-implemented per product. Evidence becomes fragmented, because each harness keeps its own partial record in its own format. And verification becomes circular, because the layer being governed is also the layer producing the assurance.

The control plane above every harness

The pattern established at the start of this path applies directly. The enterprise places a Programmable Data Agent in the traffic path between its AI harnesses and the model services they call. The PDA terminates each interaction at the protocol level, evaluates it against enterprise policy while it is in flight, and re-originates only what is allowed — without requiring changes to the harnesses on one side or the model services on the other.

Because the enforcement point is independent, it is uniform: one policy and one evidence trail across every harness and every provider. Because it operates at the protocol level, it works with harnesses it has never seen before. And because it runs inside an environment the customer governs, the evidence it produces belongs to the enterprise, not to a vendor.

The guidance’s controls, enforced on the wire

Each of the practices ASD recommends has a concrete expression at an independent enforcement point in the data path.

Answering the governance questions

The guidance closes with questions directors and executives should ask: what data, systems and tools can the agent access? What actions can it perform? Can all significant decisions and actions be monitored and audited? If the harness were compromised, misconfigured or manipulated, what would prevent or limit the outcome?

With controls implemented per harness, the answers are a collection of vendor attestations — one for each product, each on its own terms, none verifiable by the others.

With an independent control plane in the data path, the answers are evidence. What an agent could access is what the enforcement point permitted. What it did is what the record shows. And the worst outcome of a compromised harness is bounded by a layer the harness cannot reconfigure, because it does not belong to the harness.

Defence in depth, not replacement

None of this replaces the controls inside a well-designed harness. Sandboxed execution, tool permissions, approval gates and context management belong in the harness, and ASD’s guidance describes them well.

The principle is the same one that runs through this research path: a component can secure its own service, but it should not be the enterprise’s only independent control over what that component may attempt. The harness governs the agent. The enterprise still needs to govern the interaction — independently, uniformly and with evidence it owns.

That is defence in depth, which is precisely what the guidance recommends.

Conclusion

ASD’s publication marks a shift: the layer above the model is now named, described and assigned responsibility by a national cyber-security authority. The conversation about agentic AI security has moved to where it belongs.

The enterprise conclusion follows directly. Models will keep changing. Harnesses will keep multiplying. The controls that ASD calls for — least privilege, complete records, independent monitoring, bounded cost, human accountability — need a home that does not move when a model is swapped or another agent product is adopted.

The harness is the layer above the model. The control plane is the layer above every harness.

And, as this path began: the control plane must be yours.