Custom Agent Harness Designer
A harness is everything wrapped around a model to make it an agent. Google Cloud AI Research's Harness² (arXiv:2610.14224) names eight editable components — system prompt, guardrails, memory, tool guidance, subagents, skills, scripts and plugins. Compose them here, set the control loop — a parallel Propose·Probe·Compose fan-out or a sequential refine, a verifier, model routing, egress, a human gate on self-edits — and the tool draws the architecture, writes a thesis, and scores the design for capability, cost, robustness and security & governance against the Harness² baseline. Everything runs in your browser; nothing is uploaded, and the scores are honest heuristics, not benchmarks.
Google Cloud AI Research’s full self-improving harness (arXiv:2610.14224): parallel Propose–Probe–Compose, broad tools, accumulated lessons that persist into the next task’s harness. The reference design.
The eight Harness² components
8 of 8 enabled. Each carries a security note and, where PlayCISO has one, a link to the lab that drills into it. The whole-harness view lives in the Agent Harness Attack Surface Lab.
The standing instructions, role and task framing the model runs under.
Risk: Prompt injection can override the standing instructions and redirect the agent. Agent Prompt-Injection Harness Lab
Input/output policy checks; strict adds a kill-switch that can halt the loop.
Risk: Weak or bypassable checks let unsafe input/output through; no kill-switch means no mid-run stop. Agent Prompt-Injection Harness Lab
What the harness remembers; persistent adds provenance and a TTL so lessons are auditable and expire.
Risk: Unprovenanced memory is poisonable — a bad "lesson" persists and compounds across runs. Agent Memory Governance Lab
How the model is told to call tools; scoped narrows the surface, broad opens it.
Risk: A broad or untyped tool surface is attack surface — the agent can be steered to over-reach. Agent Tool-Scope Lab
Fixed, typed tool signatures the agent cannot widen at runtime.
Delegated workers the orchestrator can spawn for sub-tasks.
Risk: A delegated worker inherits trust — a compromised subagent acts with the orchestrator’s authority. Agent Subagent Delegation Trust Lab
Packaged, reusable specialist procedures the agent can invoke.
Risk: A reused skill is third-party code in the loop — supply-chain risk if unreviewed. Agent Plugin Supply-Chain Lab
Retrieve reviewed specialists on demand instead of re-deriving them.
Deterministic code steps that replace variable LLM calls where a fixed procedure exists.
Risk: Deterministic is safer, but a script with broad privileges is still blast-radius if abused.
Third-party extensions that add capability (and supply-chain surface).
Risk: Third-party plugins add capability and supply-chain surface the harness does not control. Agent Plugin Supply-Chain Lab
Control loop & orchestration
How the harness iterates: a parallel Propose–Probe–Compose fan-out, a sequential refine loop, or none.
More raises the ceiling but multiplies inference cost.
Push the branches apart so their errors decorrelate.
What sits between the model and the action: nothing, self-consistency voting, or a critic that can reject.
A single model throughout, or a cheap draft handed to a strong verifier.
Network and filesystem reach: open, or an allow-list inside a sandbox.
Egress containment is drilled in the Agent Egress Containment Lab.
Require human approval before the agent changes its own prompt, tools or guardrails.
Innovation levers
Credible upgrades that can make a harness beat Harness² on reliability, cost or safety — not just on a benchmark. Each toggle rewrites the config, so the diagram and scorecard update live.
A separate pass checks the answer before it is acted on, so a confidently-wrong draft is caught instead of shipped.
Lessons carry their source and expire, so a poisoned or stale lesson cannot silently compound across runs (the failure mode of raw accumulated memory).
Draft on a cheap model, verify/finish on a strong one — most of the quality at a fraction of the spend.
A policy layer that can halt the loop mid-run bounds the blast radius of a runaway or jailbroken agent.
Confining network and filesystem reach to an allow-list in a sandbox turns data exfiltration and SSRF from easy into hard.
Tools have fixed, typed signatures the agent cannot widen at runtime, so it cannot grant itself new reach.
Reusable, reviewed specialists are retrieved on demand instead of re-derived each run — cheaper and more consistent than ad-hoc reasoning.
A person must approve any change the agent makes to its own prompt, tools or guardrails — the single most important control for a self-improving harness.
Rewarding different approaches across the parallel branches decorrelates their errors, so the compose step has genuinely distinct candidates to pick from.
Scorecard
heuristicIllustrative design heuristics computed from your choices — not measured benchmark results. Deltas compare against the Harness² baseline preset; open “why this score” for the exact contributions.
A self-recursing harness with no human gate on privileged self-edits can rewrite its own prompt, tools or guardrails unreviewed.
Your harness vs Harness²
Architecture
Two nested loops: the task-level Propose·Probe·Compose cycle (left, parallel, k=3) and the harnessing-level loop (right) that carries the adopted harness and its lessons into the next task.
Harness thesis
Harness thesis
This design composes 8 of the eight Harness² components (System prompt, Guardrails, Memory, Tool guidance, Subagents, Skills, Scripts, Plugins) around a parallel Propose–Probe–Compose loop with k=3 branches. The orchestrator drives the model and self-consistency voting across samples selects the surviving answer.
Two loops, not one
Harness² runs on two nested loops. At the task level, the harness a parallel Propose–Probe–Compose loop with k=3 branches to solve the task in front of it. At the harnessing level, the winning harness and its evidence-backed lessons persist only for the session into the next task — without provenance, a bad lesson can compound.
How the pieces interact
The system prompt frames the task. Tool guidance is broad. The orchestrator may spawn subagents for sub-tasks. It can call skills. Scripts handle the steps that are deterministic enough not to need a model. Plugins extend reach beyond the built-in tools. Memory is kept for the session only.
The control loop
Each turn the harness proposes k=3 candidate approaches, probes them against tools and the environment, and composes the survivors into one answer. The verifier runs before anything leaves the loop.
Governance
Guardrails are basic. Egress is open. Privileged self-edits are not gated by a human.
Risk: a self-recursing harness with no human gate on its own privileged edits can rewrite its instructions, tools or guardrails without review. For a security-sensitive deployment this is the first control to add.
Tradeoffs
This configuration scores (heuristically, 0–100) Capability 92, Cost-efficiency 44, Robustness 68, Security/Governance 4.
How it differs from Harness²
- Capability: 0 vs the Harness² baseline (level with it).
- Cost-efficiency: 0 vs the Harness² baseline (level with it).
- Robustness: 0 vs the Harness² baseline (level with it).
- Security/Governance: 0 vs the Harness² baseline (level with it).
Harness² (Google Cloud AI Research, arXiv:2610.14224) maximises self-improvement with broad tools, accumulated lessons and an open loop. This design matches the baseline on governance.
Heuristic design aid from PlayCISO’s Custom Agent Harness Designer (https://playciso.com/tools/harness-designer). Scores are illustrative, not benchmarked.
What this tool is
- A free, fully in-browser designer for composing an agent "harness" — the scaffolding around a model — and getting an architecture diagram, a written thesis, and a governance-weighted scorecard. Nothing is uploaded; there are no server calls.
- It is grounded in Google Cloud AI Research’s Harness² (arXiv:2610.14224), whose harness exposes eight editable components: system prompt, guardrails, memory, tool guidance, subagents, skills, scripts and plugins. You toggle each and set its options.
- On top of the eight components you set the control loop — recursion (parallel Propose–Probe–Compose or sequential refine, with k), a verifier (self-consistency or critic gate), model routing, egress, and a human gate on privileged self-edits.
- Start from a preset — Harness² (baseline), ReAct, Reflexion, DSPy-style fixed graph, or Minimal — then edit. An "Innovation levers" panel lists credible upgrades that can beat Harness² on reliability, cost or safety, and toggling one updates the diagram and scorecard live.
- The scorecard gives heuristic 0–100 sub-scores for Capability, Cost-efficiency, Robustness and Security/Governance, each with a delta versus the Harness² baseline. Scores are illustrative design heuristics, not benchmark numbers.
Composition is a governance decision, not just an architecture one
The Harness² result is that the scaffolding around a model — not only the model's weights — is what you tune to improve an agent, and that the scaffolding can be improved recursively. That is powerful, and it is also where the risk concentrates. A harness that can edit its own system prompt, add its own tools or relax its own guardrails is a system that can quietly expand its own authority. This designer keeps that front of mind: the fourth scorecard axis is Security & Governance, and a self-recursing loop with no human gate on privileged self-edits is flagged, every time.
The point of the Innovation levers is that the way to beat a strong baseline in production is rarely a bigger model or more branches. It is a critic gate that refuses a confidently-wrong answer, memory that carries provenance and expires so a poisoned lesson cannot compound, cost-aware routing that spends strong-model tokens only where they matter, an egress allow-list and a sandbox that turn data exfiltration from easy into hard, and typed tool contracts the agent cannot widen at runtime. Each lever targets a concrete failure mode, and you can watch the diagram and the scorecard move as you add them.
Frequently asked questions
What is an agent "harness"?
A harness is the scaffolding that wraps a language model to turn it into an agent: the system prompt, the guardrails, the memory, how tools are described and scoped, any subagents, reusable skills, deterministic scripts and third-party plugins, plus the control loop that drives them. Google Cloud AI Research’s Harness² paper (arXiv:2610.14224) names exactly those eight components as the editable surface of a self-improving agent harness. This tool lets you compose that surface and see the resulting architecture, tradeoffs and governance posture.
Are the scores real benchmark results?
No. The four sub-scores (Capability, Cost-efficiency, Robustness, Security/Governance) are deterministic design heuristics computed from the options you choose, meant to make tradeoffs visible — for example, that adding parallel branches raises capability but lowers cost-efficiency, or that an egress allow-list and a human gate on self-edits raise the governance score. They are illustrative, not measured, and the tool says so throughout. It invents no benchmark numbers.
How can a harness beat Harness² without a higher benchmark score?
By being more reliable, cheaper or safer to run in production. The Innovation levers panel lists credible upgrades: a verifier or critic gate that catches confidently-wrong drafts, memory with provenance and a TTL so poisoned lessons cannot compound, cost-aware model routing (cheap draft, strong verify), strict guardrails with a kill-switch and an egress allow-list, typed tool contracts the agent cannot widen, retrieval over a reviewed skills library, a human gate on privileged self-edits, and a diversity term in the parallel compose step. Each targets a real failure mode rather than a leaderboard.
Why does the tool treat security and governance as a first-class axis?
Because a self-improving harness that can rewrite its own prompt, tools or guardrails is a security problem as much as a capability one. An open-egress, no-human-gate, broad-tool configuration can exfiltrate data or modify itself unreviewed. The scorecard gives Security/Governance equal billing with capability, flags a self-recursing loop that has no human gate, and rewards the controls — kill-switch, sandboxed allow-list, typed non-self-expandable tools, auditable memory — that bound the blast radius.
Does anything leave my browser?
No. The whole tool is client-side React with inline SVG and static data. There are no network or API calls, no account, and nothing you configure is sent anywhere. The "Copy thesis" and "Download diagram" buttons both work locally in the browser.