Secure the agentic harness.
The harness is the runtime around a model: the loop, the tool calls, the sub-agents it spawns, the MCP servers it reaches. It holds the credentials, makes the decisions, and moves at machine speed. It is the highest-value target in your agent stack, and today it runs ungoverned.
Watchlight AI Beacon governs the harness itself: every action authorized before it runs, every sub-agent held to a strict subset of authority, and a running agent contained in real time when it goes wrong.
Model
calls tools, spawns sub-agents
Watchlight AI Beacon
one policy decision · deterministic, no model in the path
Every action, governed before it runs
web_searchAllowsend_emailAllowsub-agent: widen scopeexceeds delegated authorityDenydelete_recordsno matching policyDenyDrift on sub-agent
Quarantine SeverEvery action and delegation recorded to execution lineage.
A per-call check would allow the first tool and miss the rest. Governing the harness catches the widening, the drift, and the escape.
What we mean by the harness
The model reasons. The harness acts.
An agentic harness is the scaffolding that turns a language model into an agent. It runs the plan-and-act loop, executes the tool calls, spawns and coordinates sub-agents, connects to MCP servers, and carries the credentials that make any of it real. Claude Code, the agent SDKs, LangGraph, CrewAI, and every custom orchestrator are harnesses.
The model only proposes. The harness is where a proposal becomes an action against your systems, which makes the harness, not the model, the layer that has to be governed.
It holds the credentials
Tokens, keys, and delegated authority all live at the harness. Compromise the harness and you inherit everything it can reach.
It makes the decisions real
The loop turns model output into tool calls. Every consequential action your agents take passes through it.
It moves at machine speed
A harness can execute a chain of actions and spawn sub-agents faster than any human can review a single one.
The attack surface
Five ways a harness gets turned against you
None of these are model bugs. They are runtime behaviors of an autonomous harness, which is why a smarter model does not fix them and a single tool-call check does not catch them.
Prompt-driven tool abuse
A crafted input steers the model into calling a real tool with real consequences. The harness faithfully executes what the model decided, because executing the model’s decisions is its whole job.
Sub-agent privilege widening
The harness spawns helpers and hands them work. Without a hard rule, a child agent can end up with authority the parent never held, and the widening happens deep in a call tree no one is watching.
Drift from the declared plan
The agent starts on task and wanders. At machine speed, the gap between “behaving oddly” and “doing damage” is a few hundred milliseconds, far faster than a human can triage an alert.
Escape from the framework
A high-authority agent reaches outside the instrumented path, through a spawned process, a different client library, or a compromised dependency, and acts where an in-framework hook cannot see it.
No record of what happened
When something goes wrong, log correlation cannot prove who was allowed to do what, under whose authority, and why. The harness moved too fast and left no governance-grade evidence.
The common thread
Every one of these happens after the model decides and while the harness is running. The only place to stop them is at the harness, in real time.
What good looks like
What securing the harness actually requires
Interception is table stakes. Containing an autonomous harness takes four capabilities working together. This is the Agent Runtime Governance model Watchlight AI Beacon was built around.
Decide
Deterministic authorization on every action
Each tool call is evaluated against formal, versioned policy before it runs. No language model sits in or feeds the decision, so no persuasive justification can talk its way past the rule. The same policy yields the same verdict every time.
Constrain
Sub-agents get a strict subset, with a signed record
When the harness delegates, the child receives a strict subset of the parent’s authority and the engine refuses to widen it, before the action runs. The full delegation tree is recorded as tamper-evident evidence of who was allowed to do what.
Contain
Real-time effects on a running agent
Allow and deny is not enough once a chain is in motion. Stop the run in progress, quarantine the agent, sever the downstream delegation subtree, and revoke authority across the fleet. Contain the blast radius, not just flag the bad call.
Enforce
Inside the framework and on the wire
One enforcement point inside the harness and one on the wire, both acting on a single authoritative decision. An action that slips the in-process hook still meets the proxy. Off-framework escape has nowhere ungoverned to land.
Where Beacon sits in the harness
Beacon puts a policy decision point in front of every action a harness takes. A drop-in plugin governs from inside the framework, at the plan and act stages. An on-the-wire proxy governs every outbound request regardless of the code path that produced it. Both enforce a single authoritative decision, so redundancy lives in enforcement, not in judgment.
- Same deterministic engine and the same policy at both points, no model in the decision
- Sub-agent authority validated as a strict subset, before the action runs
- Drift and anomaly feed the decision, so policy can quarantine a running agent automatically, at machine speed
- Every action and delegation captured in a tamper-evident execution record
from watchlight import govern # put a decision point in front of every tool the harness can call @govern.tool(intent="research") def web_search(query: str) -> str: ... @govern.tool(intent="modify") def delete_records(target: str) -> str: ...
pip install 'watchlight[langgraph]' # or [claude-agent], [pydantic-ai]
from watchlight.langgraph import governed_plugin
plugin = governed_plugin("watchlight.policy.json")
# pair it with the on-the-wire proxy to govern the paths
# a framework hook cannot see: off-framework escapes have
# nowhere ungoverned to land.The code you run against a harness on your laptop is the code you run in production. Going live points the same enforcement at the enterprise control plane.
See Beacon contain a live harness
Bring your framework. We will show a running agent widen its authority, drift from its plan, and try to escape the framework, and watch Beacon deny, quarantine, and seal the record in real time.