Raeez Lorgat
People who build AI agents use the term “the harness”. On its own, a model just predicts text. The harness is everything wrapped around it that turns predictions into action: the loop that feeds it context, the tools it’s allowed to call, the permission check on every action, the log of what it did. A harness couples an animal’s strength to a load and decides where the animal can pull.
The trouble with these harnesses is where the guarantee lives. There are two ways to work on the actor: make it good (alignment), or bound what it may try (the permission check). Both place the guarantee inside the actor, so it must be established one actor at a time, and the difficulty grows with the actor’s capability. The permission check makes this concrete. Forbidding a behavior requires predicting it, and a stronger model can find the moves nobody predicted.
Engineering offers a different kind of constraint. A circuit breaker doesn’t ask what caused the fault; it cuts the power either way. Railway engineers in the 1800s stopped relying on signalmen being careful and built interlocking: lever frames in which two colliding routes can’t be set at the same time. The levers physically won’t go. Neither mechanism improves the actor; each is built so that breaking the invariant requires the mechanism itself to fail.
That’s a harness too, worn by the world instead of the actor. Call the first kind a permission harness and this kind a world harness. The world harness needs no predictions. It checks the change, not the tactic, so its strength is independent of the sophistication of the actor, provided the check itself is sound with respect to the invariant. And coverage is per-world rather than per-actor: the fence is a property of the world, so whoever enters the world inherits it, including actors that don’t exist yet.
None of this is new. Security people have argued for decades that structure beats permission (capability systems against access-control lists), and Lessig’s “code is law” made the point about software generally: architecture constrains more reliably than rules do. What is new is the occasion. Where actor capability outruns the predictions a permission harness depends on, the old argument turns from a preference into a necessity.
For AI, the place a world harness would have to live is institutions: accounts, contracts, companies, licenses, payments. That’s where an agent’s actions become binding. The fences there are mostly retrospective. Double-entry bookkeeping does not prevent a fraudulent entry; it makes certain inconsistencies detectable afterward. The audit, the main institutional fence, is a search for damage that already happened. But the machinery has been drifting: a software ledger refuses the unbalanced entry before it posts. The check has been migrating from after the fact to the moment of action. Carried to its end, that migration yields institutions built as software, where the rules execute and every change is checked as it happens. A programmable institution is a world harness placed at the point where agent actions become binding.
Disclosure: the author builds programmable-institution infrastructure.
A world harness over institutions does not cover everything an AI could do wrong. It covers actions that touch money, property, and law, the domain of most audit-policed activity. A deployment uses both kinds. The permission harnesses stay, because stopping a bad action at the source is fast and cheap. The world harness bounds the consequence when an actor-side fence fails.
A world harness has an operator, and a fence run by one operator constrains every party except the operator. Whoever runs the check can change the check. If the builder can quietly move the fence, the risk is not removed but concentrated in a single operator. A government that adopted such a fence would be delegating control of its institutions to the operator. This is the adoption constraint the design must answer.
A government evaluating such a system must ask not whether the fence holds the AI but whether it holds the operator. One answer is structural: the fence binds its own builder, out of the same material as everything else. The operator’s changes go through the same check as any other party’s. The design admits no admin door. Changing the rules is itself a checked, recorded change: proposed in the open, effective from a stated date, never retroactive. Each jurisdiction runs its own copy of the check, under its own law, and whatever crosses a border gets verified again by the receiving side. In a network like that, the design goal is that no party, including the software’s author, can alter the rules without detection.
So this is one property, not two. Safety needs a world that refuses illegal changes no matter how clever the actor. Sovereignty demands a network that no operator can quietly bend; the property elsewhere termed neutrality. It’s the same fence, seen from the actor’s side and from the owner’s. And the two can’t be separated: a fence with a door fails both tests at once, because the door turns the world harness back into a permission harness at the one spot where the most capable actor stands. The operator is an actor too.
The limit is one: a world harness guarantees only that actions inside the wrapped world follow the rules as written. Two consequences follow. The first is coverage. The fence governs only the world it wraps. An actor can go around it: persuade a human, act through systems that check nothing. So the guarantee grows only as fast as the coverage, and coverage is an adoption problem: the wrapped world must be the easiest place to act, the fastest way to start a company, to move money, to establish identity. If agents select the lowest-friction path, the legal path must be the easy path. If the legal path is the easy path, coverage grows with each actor that picks it.
The second is content. A world harness enforces rules as written. It cannot determine what the rules should say. Where the law leaves room for judgment, the judgment stays with people; the machine records who decided, and on what authority.