An LLM that only returns text is not yet an agent. A harness coordinates tools, results, state, and recovery, turning tool integrations into a working agent loop. section 7.9 section 7.9.1
Separate orchestration from execution:
- The harness owns the agent loop, state, tool routing, approvals, tracing, and output channels. section 7.9.1
- The sandbox runs code and commands in isolation; credentials and sensitive data remain in the harness. If execution crashes, the harness can restore a checkpoint. section 7.9.1
Implementations
OpenAI’s agents SDK and Codex CLI illustrate model-native harnesses paired with sandboxed compute. OpenClaw illustrates a model-agnostic, community-extensible harness; NemoClaw uses OpenShell for enterprise sandboxing. section 7.9.1
Figure 7.4 The harness owns the agent loop, memory, and LLM communication. The sandbox executes code in isolation with no direct model access. Tasks flow right; results flow left. If the sandbox crashes, the harness recovers.
Use the diagram to trace task flow from harness to isolated sandbox and results back, including recovery after a sandbox crash. section 7.9.1
