Raeez Lorgat
People who build AI agents talk about “the harness” all the time. On its own, a model just predicts text. The harness is everything wrapped around it that turns predictions into action: the loop that feeds it context, the tools it’s allowed to call, the permission check on every action, the log of what it did. The word comes from horses. A harness is the rig that couples an animal’s strength to a load, and it decides where the animal can pull.
The trouble with these harnesses is where the guarantee lives. There are two ways to work on the actor: make it good (alignment), or bound what it may try (the permission check). Both are worth doing, and both put the guarantee inside the actor, so you establish it one actor at a time, and the more capable the actor, the harder that gets. The permission check is the starkest case. To forbid a behavior you have to predict it, and a stronger model finds the moves you didn’t. A fence made of predictions gets weaker as the thing inside it gets stronger.
When your fence weakens as its occupant strengthens, you need a different kind of fence, and the world is full of them. A circuit breaker doesn’t ask what caused the fault; it cuts the power either way. Railway engineers in the 1800s stopped relying on signalmen being careful and built interlocking: lever frames in which two colliding routes can’t be set at the same time. The levers physically won’t go. Nobody here tried to improve the actor. They made the world hard to break.
That’s a harness too, worn by the world instead of the actor. Call the first kind a permission harness and this kind a world harness. The world harness needs no predictions. It checks the change, not the tactic, so the brilliant adversary and the careless one hit the same wall, and it doesn’t weaken as models improve. And one covers everyone: the fence is a property of the world, so whoever enters the world inherits it, including actors that don’t exist yet.
None of this is new. Security people have argued for decades that structure beats permission (capability systems against access-control lists), and Lessig’s “code is law” made the point about software generally: architecture constrains more reliably than rules do. What’s new is the occasion. The actors are getting smarter faster than we can update our predictions about them, which turns the old argument from a preference into a necessity.
For AI, the place a world harness would have to live is institutions: accounts, contracts, companies, licenses, payments. That’s where an agent’s actions become binding. The fences there are mostly retrospective. Even double-entry bookkeeping, the best of them, never stopped a crooked clerk; it made certain lies visible later. The audit, our main institutional fence, is a search for damage that already happened. But the machinery has been drifting: a software ledger refuses the unbalanced entry before it posts. The check has been migrating from after the fact to the moment of action. Carry that migration to the end and you get institutions built as software, where the rules execute and every change is checked as it happens. A programmable institution is a world harness standing where the strongest actors are headed.
Here I should declare an interest: building that is what I do all day. Discount accordingly. I think the argument survives the discount because its hardest requirement didn’t come from us, and it points at us.
A world harness over institutions doesn’t cover everything an AI could do wrong; nothing does. It covers actions that touch money, property, and law, which is where agents can do the most durable damage, and nearly all of what we now police by audit. So the plan uses both kinds. Keep the permission harnesses, because stopping a bad action at the source is fast and cheap. Let the world harness carry the load, because sooner or later something gets past the actor-side fence.
Now the serious objection. A world harness has an operator, and a fence run by one operator protects you from everyone except the operator. Whoever runs the check can change the check. If the builder can quietly move the fence, you haven’t removed the risk, you’ve concentrated it: instead of a thousand unpredictable agents, one very predictable company. No government would put its institutions inside a fence like that, and none should.
This is the requirement that came from outside, the part I know from experience rather than argument. Governments don’t ask whether the fence will hold the AI. They ask whether it will hold us. The only answer that survives that question is structural: the fence binds its own builder, out of the same material as everything else. The operator’s changes go through the same check as everyone else’s; there is no admin door. Changing the rules is itself a checked, recorded change: proposed in the open, effective from a stated date, never retroactive. And nobody is the only referee. Each jurisdiction runs its own copy of the check, under its own law, and whatever crosses a border gets verified again by the receiving side. In a network like that, nobody bends the rules quietly, including whoever wrote the software.
So this is one property, not two. Safety needs a world that refuses illegal changes no matter how clever the actor. Sovereignty demands a network that no operator can quietly bend; governments call that neutrality. It’s the same fence, seen from the actor’s side and from the owner’s. And the two can’t be separated: a fence with a door fails both tests at once, because the door turns the world harness back into a permission harness at the one spot where the most capable actor stands. The operator is an actor too.
The limit has two faces. The fence governs only the world it wraps. An actor can go around it: persuade a human, act through systems that check nothing. So the guarantee grows only as fast as the coverage, and that puts the real work in an unglamorous place: the wrapped world has to be the easiest place to act, the fastest way to start a company, to move money, to prove you are who you say you are. People go where friction is lowest, and AIs will too. If the legal path is the easy path, coverage grows because everyone picks it. Safety usually arrives at scale as a side effect of convenience, when it arrives at all.
The second face is deeper. A world harness enforces rules as written. It can’t tell you what the rules should say. Where the law leaves room for judgment, the judgment stays with people; the machine records who decided, and on what authority. A perfect fence around a bad law gives you perfectly enforced bad law.
Which is all in the old word. A harness has two jobs: turn strength into work, and decide where the strength can go. It never had a third. Choosing the field was the farmer’s job. It still is.