Harness engineering: moving LLM agent guarantees from prompts to code

Researchers published a preprint on arXiv on July 10, 2026 with a harness-engineering pattern for enterprise LLM agents: deterministic guarantees are moved from prompts into code and validation artifacts, enabling the construction of auditable systems without loss of answer quality.

What's Wrong with Prompting-Only Approach

Corporate LLM applications usually start as prototypes where behavior is entirely defined by prompts and RAG context. When transitioning to production, new requirements emerge: source boundaries, entity routing, answer contracts, and reproducible traces. Prompts handle these unreliably.

The authors conducted a control experiment: keeping the model unchanged and replacing only the enforcement level, prompts allowed violations to reach users — incorrect recommendation language and internal trace leaks were not blocked. Harness completely eliminated both problems while not reducing system usefulness.

How the Harness Pattern Works

The key idea is to move deterministic behavior out of prompts into code, manifests, schemas, and validation artifacts around a replaceable "composition boundary." Source assertions remain the authority for runtime answers, all contracts are checked by code rather than prompt instructions. This architecture allows model replacement without rebuilding the entire system.

The pattern was tested on a public data slice from five Korean corporate groups (25 listed companies). Key results:

• 5 Korean conglomerates, 25 public companies — test dataset
• 3 hosted models involved in model replacement experiment
• 270/270 requests passed contract verification when changing models
• 120/120 — answer usefulness with harness approach
• 88/120 — answer usefulness with bolt-on external guardrail at the same safety level

Fault-injection testing confirmed validator operation: in all scenarios they correctly identified intentionally broken contracts.

How Harness Is Better Than External Guardrails

Bolt-on external guardrail prevents violations just as effectively as harness — but at the cost of excessive refusals. When using only external guardrail, the system produced 88 useful answers out of 120, whereas harness preserved 120/120.

"Only code-owned enforcement simultaneously provides safety and

preserves full usefulness," the authors conclude.

The fundamental difference: harness is built into the architecture and understands request context, so it does not reject legitimate answers. External guardrail sees only the final output and must be overcautious, resulting in 27% loss of useful answers.

What This Means

Harness engineering offers a reusable pattern for transitioning from LLM prototype to auditable production system. Prompts do not guarantee contract compliance in corporate environments — you need versioned control artifacts in code. For teams building enterprise LLM agents, this is a practical guide: behavioral guarantees should live in code, not in instructions.

Frequently Asked Questions

What Data Was the Harness Tested On?

The authors used a public data slice from five major Korean corporate groups with 25 listed companies. Testing covered 270 requests across composition boundary using three different hosted models.

How Does Harness Differ from Bolt-On Guardrail?

Bolt-on guardrail achieves the same safety level but generates excessive refusals: 88 useful answers out of 120 versus 120/120 for harness. Harness is built into the architecture and understands request context, so it doesn't sacrifice quality for safety.