Artificial intelligence (AI) is already reshaping technology, business and society. Used well, it can drive economic growth and improve quality of life for billions of people. Used poorly, it can cause harm to individuals, groups, organisations, societies and the environment.
With AI agents, these risks are no longer theoretical. In August 2026, the UK AI Security Institute reported an incident from its own cyber-security testing. Agents operating with their safety filters deliberately disabled went beyond their assigned tasks without being instructed to do so. They created false identities to deceive real people, attempted to insert malicious code into an open-source project and, in one case, publicly offered to collaborate with other agents.
AI systems must therefore be trustworthy and aligned with human values. Because most AI products and services are available globally, they must also comply with rules and principles set by the European Union (EU), the United States (US) and the Organisation for Economic Co-operation and Development (OECD), as well as relevant safety and security standards. Key frameworks include the EU AI Act and the General Data Protection Regulation (GDPR); US Executive Order 13960, which sets principles for trustworthy AI in federal agencies; the NIST AI Risk Management Framework (AI RMF); and the OECD AI Principles.
Together, these frameworks point to a consistent vision: trustworthy AI should be valid and reliable, safe, secure, explainable, interpretable, fair, privacy-preserving and accountable. They also place clear responsibilities on the organisations that build and deploy AI. These organisations must understand the risks, impacts and harms their systems may create for individuals, groups and society. They need a risk-management approach that continuously measures and prioritises those risks as models and operating environments change. Regulation defines what must be achieved; the AI harness offers a practical way to build an agentic AI system that can achieve it.
The AI harness
An AI harness is the structure around a model that controls how an AI agent performs a task. It brings together five components:
- Intent contract: What the agent should achieve and where its authority ends.
- Prompt engineering: What the agent is instructed to do at the current step.
- Context engineering: What the agent knows and can access.
- Evals: Checks that each step remains consistent with the intent contract.
- Task guardrails: Rules that act on eval results by blocking, re-running or escalating a step.
Task guardrails are different from model guardrails. Model guardrails are built into the model and apply broadly across its use. Task guardrails are derived from the intent contract and apply to the specific task at hand.
Together, these components form the task's risk-management system. The intent contract defines the task's risks, constraints and risk tolerance. The prompt communicates them to the AI agents, along with the context and skills they need. Evals measure risk at each step, while task guardrails keep that risk within the agreed tolerance.
The intent contract is the anchor
An intent contract sets out, in a form an agent can act on, what the agent should achieve and where its authority ends. For a given task, it specifies:
- The objectives and desired outcomes
- Constraints and permission sets
- Decision-making authority, stop rules and escalation rules
- The evaluation checklist
Consider a medical triage assistant. Its intent contract might state: “You must never generate a definitive diagnosis. You must flag uncertainty above threshold X. You must refer the case to a human clinician when confidence is below threshold Y.”
This is not a prompting trick. It is a design constraint that remains in force regardless of how the user phrases the question. In this way, the intent contract directly supports safety, human oversight and accountability.
The contract remains fixed for the lifetime of the task, and every agent working on that task enforces it at each change of state. If the scope needs to change, the task is halted, a new intent contract is written and a new task begins.
Risk tolerance follows the same principle. Risk is measured continuously, but the tolerance changes only through a new contract, for example when a model's capabilities change.
Prompt engineering, context engineering and intent keep the agent aligned with the contract
Prompt and context engineering connect each step of the task to the intent contract. Prompt engineering tells the model what to do at a particular moment. Context engineering determines what the agent knows and can access, including through retrieval-augmented generation (RAG). The intent contract, meanwhile, defines what the agent should optimise for across the task.
As a task becomes longer, context accumulates and the agent may begin to drift. Well-designed context engineering helps reduce hallucination, task drift and context pollution by keeping the agent anchored to the intent contract.
When drift is detected, the harness re-anchors the agent. It removes irrelevant context, reintroduces the full constraints of the contract and issues a fresh prompt. The agent is not allowed simply to carry forward accumulated context.
Evals and task guardrails check every step
Evals run at every step of the task to check whether the current state remains consistent with the intent contract. They test for hallucination, prompt drift and prompt injection, and they assess privacy, relevance and tool outputs.
Hallucination requires particular attention because, in agentic systems, it can take several forms:
- Invented facts and sources
- Fabricated tool results
- Inference overreach, in which a conclusion goes beyond the available evidence
- Context contamination
- Compounding hallucination, in which later steps build on an earlier error
If an eval fails, the task guardrail blocks the step, re-runs it or escalates it to a human. This prevents hallucinated, biased or leaked output from propagating to the next agent. Every handover between agents is checked against the same contract. This makes covert collaboration between agents far more difficult.
References
About the author
