Production AI Agents Need Control Harnesses, Not Just Powerful Models

Building AI agents that work reliably in production means far more than having a capable language model. The gap between what an agent appears to do and what it actually commits to durable storage—what one engineer calls a "silent success" failure—exposes a fundamental truth: models need harnesses.

Vinoth Govindarajan, a member of OpenAI's core data and AI infrastructure team with roots in distributed systems at Uber and Apple, opened a talk at InfoQ by walking through a concrete failure: a user asked an agent to remember a refund for a customer. The assistant said it would remember. From the user's perspective, everything looked fine. But the durable record never saved the interaction, and the agent had no memory for the next conversation turn. The reply appeared to succeed, yet the underlying state was broken.

"A crash is annoying," Govindarajan noted, "but it gives you a boundary. Silent success is worse. It's a lie."

The Production Contract#

The lens Govindarajan proposes is a contract between three parts of the system:

• The model proposes — it outputs tool calls, messages, edits, or plans
• The harness commits — the surrounding system decides whether the proposal is safe, ordered, and authorized
• The receipt proves it — evidence survives showing what woke the system, what state it inherited, what was proposed, evaluated, and executed

This reframes the engineering challenge. Once an agent can send a message, update a database, or trigger a workflow, the questions change from "Did the model answer correctly?" to three harder ones:

• Who owns the state?
• Who committed first, and in what order?
• Who can show what happened—not what the model intended, but what persisted at the user-visible edge?

"These are not model questions," Govindarajan emphasized. "These are production questions."

The Harness Blueprint#

A reference architecture uses a pattern seen across personal assistants like OpenAI's own products and coding agents like Claude Code. Events enter from multiple surfaces—webhooks, timers, user messages, external systems. A control plane maps each event to a session key, which determines the state boundary. A session lane enforces a single writer to the commit path. A global throttle protects the whole system. The runtime calls tools and models. An audit trail becomes the receipt.

Within this structure, Govindarajan extracted three core principles for reliability: