You add a paragraph to the project’s instructions. This module does not call that one, ever, and here is the reason. For a while it holds. Months later you open the dependency graph and the boundary has four holes in it. You go back through the sessions looking for the act of disobedience and there isn’t one. Each crossing arrived in a run where your paragraph was a line of context among thousands, and the deadline was concrete while the rule was prose. You wrote a guide and filed it in your head as a control. A guide points. It never checks whether anyone arrived.

A greenhouse holds its warmth three ways

A greenhouse in March stays warm because of three things working at different speeds. A vent in the roof rides on a wax cylinder that expands when the air heats up, opening in seconds, with nobody deciding anything. A heater cuts in a few minutes after a sensor reads below the line. And on Saturday the grower walks the rows and finds the corner that never thaws, because a bench is sitting across the pipe, which is not a thing any sensor was going to phrase for him.

A harness regulates an agent the same way. Some of its controls run before the work: conventions, architecture, the written procedure for how a change gets made. Others run after and only report: tests, lint, quality checks, what the running system does, how far this month has drifted from last. Neither half is the point on its own. The regulation happens when a deviation turns into a correction somebody can verify.

Take one property, module boundaries. A skill states them, so the agent reads them before writing. An architecture test checks them at every commit, in seconds, and fails the build. A periodic agent goes looking for two functions doing the same job under different names, which no linter can classify. Same property, three controls, three speeds. Remove one and the property is held only as often as the survivors happen to look.

Risk decides which kind of control you build

The controls come in two kinds, and the difference matters more than it looks. A computational one is deterministic: a type check, a contract test, a gate that either passes or does not, with the same answer every time you run it. An inferential one asks a model for a judgment, about naming, about whether an abstraction still earns its place, and gives you a reading rather than a verdict. Wire a probabilistic check into a position where the build depends on it and you have a gate that quietly disagrees with itself on alternate Tuesdays.

Where you place a control decides what a correction costs. A boundary violation caught while the agent is still working is a rename. Caught at commit, it is a small revert. Caught in production, it is a migration with a meeting attached. So the two failure patterns are predictable: guides with nothing measuring their effect, which is the paragraph in the instructions file, and sensors that only fire late, which is discovering in October what was cheap to fix in March.

This is also the honest answer to what you leave an agent alone with. Unattended work is safe on exactly the properties you can sense cheaply and often. Everything else needs a person at the end, and pretending otherwise is not trust, it is an absent sensor.

You cannot regulate what you cannot sense

Which turns into a question you can ask before adopting anything. Given two integrations, one with a typed schema, a stable interface and a test you can run locally, the other without, the first lets the harness hold a type check, a contract test and a boundary rule. The second leaves you reading every change by hand. That difference is not a detail of the library. It decides how much regulation you can afford, and it is a fair thing to weigh against the demo that looked faster.

Nobody plants a crop whose needs the house has no way to sense or hold. Codebases are not equally governable either, and debt is mostly the process of making boundaries too vague to test, after which every control you add costs more than it would have at the start. The same reasoning runs through when the agent has to look: what the loop can observe sets what it can correct. A harness is a regulator, and a regulator has to be as varied as the thing it regulates.