---
title: "AI Agent Harness Components: What Each Piece Does and Which Vendors Solve It"
description: "Every component of an AI agent harness explained in plain terms, with the vendors and open-source tools that cover each one, so you can judge agent proposals."
url: https://addabra.com/en/blog/ai-agent-harness-components-and-vendors
lang: en
date: 2026-11-02
category: "Harness engineering"
keyword: "ai agent harness components"
publisher: Addabra
alternate: https://addabra.com/blog/componentes-ai-agent-harness-proveedores
---

# AI Agent Harness Components: What Each Piece Does and Which Vendors Solve It

> Every component of an AI agent harness explained in plain terms, with the vendors and open-source tools that cover each one, so you can judge agent proposals.

You are comparing three proposals for your first AI agent in production. All three say "agent platform". One talks about the model, another about integrations, the third about dashboards. None of them shows you the whole picture, so you cannot tell what you are buying and what you will discover is missing in month three.

This guide explains every component of an AI agent harness in business terms, and for each one lists the vendors and open-source tools the market offers today. Use it as a map: the diagram below shows the whole system, and the sections that follow walk through it piece by piece.

## Agent = model + harness

A harness is the runtime system around a large language model (LLM). The model reasons; the harness does everything else: it assembles the context, runs the loop of thinking and acting, executes tools safely, remembers, applies your rules, asks a person for approval when it matters, and records what happened.

The formula "agent = model + harness" became popular in 2026, when Mitchell Hashimoto coined the term "agent harness" and LangChain formalized the definition. The idea matters for buyers: two companies can use the same model and get completely different results, because the difference lives in the harness. We go deeper in [what harness engineering is](https://addabra.com/en/blog/what-is-harness-engineering).

## The model layer: the reasoning engine

The model decides what to do next. It does not execute anything by itself, and it does not remember your business between conversations.

- **Frontier model providers:** OpenAI (GPT), Anthropic (Claude), Google (Gemini).
- **Open-weight models:** Meta Llama, Mistral, Qwen, DeepSeek, which you can host in your own infrastructure.
- **Enterprise access through your cloud:** AWS Bedrock, Google Cloud Vertex AI and Microsoft Azure AI Foundry offer several of these models under your existing contracts and data agreements.
- **Model gateways and routers:** LiteLLM, OpenRouter, Portkey and Cloudflare AI Gateway put one interface in front of many models, so you can route each task to the best model and switch if a provider fails.

A good harness treats the model as a replaceable part. If changing models means rewriting the system, the harness is too thin.

## The control plane: the ten modules of the harness

This is the heart of the diagram, the green block. Each module solves a specific problem that a demo hides and real operations expose.

### Prompt assembler

It builds what the model sees on every step: instructions, the relevant slice of memory, available tools and the current task. Too little context and the agent guesses; too much and it gets confused and expensive. This discipline is called context engineering.

Market options: frameworks such as LangChain, LlamaIndex and DSPy help assemble and optimize prompts; Langfuse, PromptLayer and Braintrust version and manage prompts so changes are tracked like code.

### Agent loop engine and multi-agent router

The loop engine runs the cycle shown on the right of the diagram: think, plan, act, observe, reflect, answer. The router decides which agent handles which part of the work when there is more than one, usually with a supervisor agent that delegates to specialists.

Market options:

- **Open-source frameworks:** LangGraph, OpenAI Agents SDK, Claude Agent SDK, Google Agent Development Kit (ADK), Microsoft Agent Framework, CrewAI, Mastra, Pydantic AI and AWS Strands Agents.
- **Managed runtimes:** AWS Bedrock AgentCore, Google Cloud's agent runtime on Vertex AI and Azure AI Foundry Agent Service run agents for you with isolation, identity and scaling.
- **Agent-to-agent protocol:** A2A, an open protocol started by Google, lets agents built on different frameworks talk to each other.

### Tool registry

The list of actions an agent can take, with a contract for each: what it receives, what it returns and who is allowed to call it. Without a registry, every agent integrates every system its own way and nobody knows what it can touch.

Market options: the Model Context Protocol (MCP) has become the common standard for exposing tools to agents. Composio, Arcade.dev, Zapier and Pipedream offer large catalogs of ready connectors, and cloud gateways such as AgentCore Gateway turn existing APIs into tools with authentication.

### Memory manager

It decides what the agent reads from and writes to memory on each step, and with which permissions. It is the module that turns separate conversations into a system that learns your business. The memory layers themselves are covered further down.

### Policy engine

The rules the agent cannot break: which data it can see, which actions require approval, how much it can spend. Policies should live outside the prompt, because a prompt can be manipulated and a policy engine cannot.

Market options: authorization engines such as Open Policy Agent, Cerbos, Permit.io and Amazon Verified Permissions (Cedar); guardrail toolkits such as NVIDIA NeMo Guardrails, Guardrails AI and Llama Guard; and managed guardrails in AWS Bedrock Guardrails and Azure AI Content Safety.

### Session and state manager, retry and recovery manager

Real processes take minutes, hours or days, and providers fail. These modules save the state after each step so a failure means resuming from the last good point instead of starting over or, worse, duplicating an action such as sending an invoice twice.

Market options: durable execution engines such as Temporal, Inngest, Restate, DBOS and Trigger.dev; LangGraph checkpointers persist the state of a graph. This is one of the most forgotten pieces in pilots and one of the first to cause damage in production.

### Human approval manager

The checkpoints where the right person signs before something important leaves the company: a proposal, a refund, a contract clause. It needs to know who approves what, notify them where they work and record the decision.

Market options: LangGraph interrupts and Temporal signals pause a workflow until a person responds; HumanLayer specializes in approvals over Slack, email and other channels. In most companies the approval screen ends up inside the systems people already use, which is why we treat it as part of the build, not a separate product. More in [human approval by role](https://addabra.com/en/blog/human-approval-by-role).

### Tracing and telemetry

The record of what every agent did, with which data, how long it took and how much it cost. Without it, nobody can explain an error or prove the agent works.

Market options: Langfuse, LangSmith, Arize Phoenix, Braintrust, Helicone, Traceloop (OpenLLMetry) and Weights & Biases Weave; Datadog, Dynatrace and New Relic have added LLM and agent monitoring to their platforms. OpenTelemetry's generative AI conventions are becoming the standard format, which keeps you free to change tools.

## Tools: what the agent can act on

Tools are how the agent touches the world: search the web, read files, query a database, send an email, update the CRM, run code.

- **Web search for agents:** Tavily, Exa, Brave Search API and Perplexity's Sonar API return results formatted for models.
- **Reading the web:** Firecrawl and similar services turn pages into clean text; Browserbase and Steel run real browsers for agents that need to navigate.
- **Your business systems:** CRM, ERP, ticketing and email through their APIs, ideally exposed as MCP tools with minimal permissions per agent.

The rule is simple: every tool is a door. Give each agent only the doors its process needs.

## Sandbox: where code runs safely

When an agent writes and runs code, for example to analyze a spreadsheet, that code must run in an isolated environment with limits on CPU, memory, network and files, so a mistake or an attack cannot reach your systems.

- **Hosted sandboxes for agents:** E2B, Daytona, Modal, Vercel Sandbox, Cloudflare Sandbox, Runloop, Blaxel and Northflank, each with different trade-offs in startup speed, persistence and GPU support.
- **The underlying technology:** Docker containers, gVisor, Firecracker microVMs (stronger isolation) and WebAssembly runtimes such as Wasmtime for lightweight, tightly limited execution.
- **Managed code interpreters:** cloud runtimes such as AgentCore include a code interpreter as a service.

## Memory layers: from session to business brain

Memory is what separates an assistant that forgets from a system that knows your clients, rules and history. The diagram shows four layers:

- **Short-term:** the current session and task.
- **Long-term:** facts and documents retrieved by meaning, usually in a vector database such as Pinecone, Weaviate, Qdrant, Milvus (Zilliz), Chroma, Turbopuffer or Postgres with pgvector.
- **Episodic:** what happened in previous runs, taken from traces, so the agent does not repeat mistakes.
- **Knowledge base:** structured business knowledge such as policies, prices and client files.

Specialized memory layers such as Mem0, Zep (temporal knowledge graph) and Letta (agents that manage their own memory) sit on top, and the cloud runtimes now include managed memory. Whatever you choose, the content of that memory is your most valuable asset; it should live in storage you control. We call it the [company brain](https://addabra.com/en/blog/company-brain-business-memory).

## Observability and evals: proving it works

Tracing tells you what happened. Evals tell you whether it was good. The improvement loop in the diagram is: define tasks from real cases, run the agent, score the results, analyze failures and improve prompts, tools, policies or model, then run again before every change reaches users.

Market options: Braintrust, LangSmith, Langfuse, Arize, Galileo and Patronus AI combine datasets, scoring and experiments; Promptfoo, DeepEval, Ragas and Inspect AI (from the UK AI Security Institute) are popular open-source frameworks. Details in [evals for AI agents in production](https://addabra.com/en/blog/evals-for-ai-agents-in-production).

## Safety and control layers

Safety is not one product; it is seven layers that work together:

| Layer | What it prevents | Example vendors and tools |
|---|---|---|
| Input validation | Prompt injection and malicious content | Lakera (Check Point), Prisma AIRS (Palo Alto Networks), Cisco AI Defense, Llama Guard |
| Tool permissions | Agents touching systems they should not | MCP gateways, Open Policy Agent, Cerbos, Permit.io |
| Dangerous action detection | Irreversible actions without review | Policy engine rules plus guardrails such as NeMo Guardrails |
| Human approval | Unreviewed decisions reaching clients | LangGraph interrupts, Temporal, HumanLayer |
| Secrets and data protection | Leaked keys and personal data | HashiCorp Vault, AWS Secrets Manager, Doppler, Infisical |
| Rate limits and spend caps | Runaway loops and surprise bills | LiteLLM, Portkey, Kong AI Gateway, Cloudflare AI Gateway |
| Audit and compliance | Not being able to explain a decision | Trace stores plus frameworks such as ISO/IEC 42001, NIST AI RMF and the EU AI Act |

See [AI agent security](https://addabra.com/en/blog/ai-agent-security) for how these layers fit a real deployment.

## Buy, assemble or commission?

Look at the diagram again: there is no single vendor in the market that covers every box for your company. Cloud providers and frameworks cover more of it every quarter, and that is good news, because it lowers the cost of the plumbing. What no vendor can sell you is the part that is specific to you: your processes, roles, approval rules, business memory and evals built from your real cases.

Common mistakes when assembling a harness:

- **Buying ten tools and wiring none of them.** Each piece works alone; the value is in how state, approvals, traces and memory connect.
- **Putting rules in the prompt.** Policies and spend caps belong in the harness, where they cannot be talked around.
- **Skipping recovery and tracing in the pilot.** They are invisible in a demo and decisive in production.
- **Letting a vendor own your memory and evals.** They are the hardest assets to move later.

We compare the three paths in [build, buy or commission](https://addabra.com/en/blog/build-buy-or-commission).

## How Addabra approaches it

At Addabra we build each company's harness on our own proven base, which already covers the control plane modules in this diagram, and we choose market components where they are the best option for the case: the right model per task, open standards such as MCP and OpenTelemetry, and memory and evals in your infrastructure. The result is yours: code, memory and data.

*Vendor names in this guide are examples of what the market offers as of November 2026, not endorsements or a ranking. This market moves fast: verify current capabilities and terms before choosing.*

## Frequently asked questions

### Can I buy a complete AI agent harness from a single vendor?

Cloud providers and agent frameworks cover more of the harness every quarter, but none of them knows your processes, roles, approval rules or business memory. In practice you combine a framework or managed runtime with several specialized pieces, and the work that makes it reliable is how those pieces are wired to your operation.

### Which harness components matter most for a first agent in production?

Start with the agent loop, a tool registry with minimal permissions, human approval on anything that touches money or clients, tracing and a small eval suite built from real cases. Multi-agent routing, advanced memory and sandboxed code execution can come later, when a process actually needs them.

### How do I avoid lock-in when choosing harness vendors?

Favor open standards such as MCP for tools and OpenTelemetry for traces, keep your memory and eval datasets in storage you control, and route models through a gateway so you can switch providers. The pieces that are hardest to move later are your business memory and your evals, so own those from day one.

## About Addabra

Addabra is an AI-software-first software factory that designs and builds custom agentic systems for companies: one agent per process, a shared business memory, orchestration, human approval by role, auditing and cost control. Free diagnosis: https://addabra.com/en/blog/ai-agent-harness-components-and-vendors#contacto