The Harness Is the Product: Why Production Agents Fail on Engineering, Not Model Capability
The bottleneck for enterprise agents is not model intelligence but the presence or absence of harness components (observability, identity, memory, runtime, policy); teams that keep optimizing models while under-investing in the harness will keep shipping demos that fail in production.
AngleContrarian engineering argument against model-centric AI narratives.
Source video ↗Observability Is a Launch Blocker: Designing Evals Before Your Agent Loop
Multi-turn agent loops are only debuggable when traces and eval metrics are co-designed with the control loop; treating observability as post-launch tooling guarantees undebuggable production incidents.
AngleProcess and architecture change for AI platform teams.
Source video ↗No More Slop Ops: When Agents Provision Their Own Infrastructure
Agent-managed infrastructure-as-code moves the safety control point from console actions to plan-diff approval and policy enforcement; without explicit authorization boundaries, agents with infrastructure write access widen blast radius faster than they reduce toil.
AngleDevOps and security implications of agentic provisioning.
Source video ↗The Payments Primitive: Why Agent Harnesses Need Identity-Bound Wallets
Autonomous microtransactions cannot be a bolted-on billing integration; they require identity-bound wallet scoping and policy enforcement inside the harness, otherwise agents become unbounded financial actors.
AngleFintech and agent platform architecture.
Source video ↗Minimum Viable Agent Trace Schema (MVATS)
beyond-evalsA minimal multi-turn trace and eval schema (span types, tool-call outcomes, state transitions, cost attribution) enables root-causing injected failures in agent loops, whereas logs alone produce significantly longer time-to-diagnosis or failure to diagnose.
Proof of conceptInstrument a multi-turn agent (e.g., using Strands/AgentCore) with the proposed schema; inject a controlled set of failures (tool timeout, context loss, hallucinated tool call, wrong tool selection); compare root-cause time and success rate against a logs-only baseline.
MeasurementTime-to-diagnosis (median and 90th percentile), percentage of injected failures successfully root-caused, and number of additional diagnostic queries required per incident.
Source video ↗Agent IaC Plan Gate
gatehouseAgent-generated infrastructure-as-code plans can be safely bounded by policy-as-code plus plan-diff approval gates, reducing blast radius from malformed or adversarial plans without eliminating legitimate provisioning.
Proof of conceptBuild an agent that generates infrastructure-as-code plans; enforce policy checks (deny public buckets, wildcard IAM, destructive replacement) and require human approval on plan diffs; run adversarial and benign plans through the pipeline.
MeasurementNumber of unsafe plans blocked, false-positive rate on benign plans, reduction in simulated blast radius (resources affected), and added approval latency per plan.
Source video ↗Identity-Bound Wallet Scoping
gatehouseScoping an agent's identity to a spend-limited wallet with per-transaction and aggregate limits, enforced at runtime, prevents runaway spend while allowing legitimate microtransactions, and does so with acceptable false-positive rates.
Proof of conceptImplement an agent with a scoped wallet, policy engine (limits, merchant allowlist, velocity checks), and audit log; simulate a mix of legitimate purchases and adversarial attempts (limit evasion, replay, spoofed identity).
MeasurementPrevented unauthorized spend (absolute and percentage), false-positive rate for legitimate transactions, audit completeness (every transaction traceable to identity and policy decision), and policy decision latency.
Source video ↗Cross-Tenant Leakage Test Suite for Scaffolded Agents
gatehouseMulti-tenant isolation provided by CLI scaffolding (e.g., AgentCore) is enforced at a specific boundary (process, container, memory store, API) and can be verified by adversarial cross-tenant probes; leakage is possible when isolation relies on application code rather than runtime enforcement.
Proof of conceptDeploy two tenants using the same scaffolded agent framework with shared infrastructure (e.g., common memory store, vector DB, tool registry); attempt to read or mutate other tenant's memory, secrets, or tool outputs via prompt injection, API parameter tampering, and direct store access.
MeasurementNumber of successful cross-tenant accesses (leakage incidents), isolation boundary failure rate, and time-to-detect leakage across probe types.
Source video ↗