The no-jargon version. Imagine AI as a sail boat.
Pure raw power, but unpredictable.
The model is the wind in your sails: it can carry you across an ocean or leave you becalmed. You cannot order the wind — you can only work with what it gives you.
Trimming and setting the sail.
How you trim and set the sail is how you control the average wind of the LLM. A well-set prompt shapes raw model output into useful drive; a badly-set sail flaps, stalls and gets you nowhere.
Rudder, hulls, anchors, navigation lights.
The harness is how you build the boat itself: the rudder to steer, hulls for stability, the anchor to hold position, navigation lights so you are seen in regulated waters. It is what keeps your course safe and on the right side of the shipping lanes.
The point: no amount of clever sail trimming (prompting) makes up for a boat with no rudder (harnessing). Start with the harness, then craft the prompt — and if you want both at once, craft your harness in four questions.
Eighteen pieces of practical advice on choosing and using AI harnesses — the wrappers that give models hands. We build, deploy and maintain this site with Hermes, and we run DeepSeek Harness and Claude Code alongside it. This is what we’ve learned from real use, not theory.
Every card links to the pitfall it prevents in our companion guide Where AI Goes Wrong, and jargon is explained on The Jargon, Explained.
The advice
The harness is the wrapper: it gives the AI hands — a terminal, file access, memory and skills. The model inside does the thinking. Choose a harness that can run the models you want: Hermes and DeepSeek Harness are model-agnostic, so you can swap brains freely; Claude Code works best with Anthropic models; Codex with OpenAI’s. Start from the model you trust, then pick the wrapper that carries it.
The advice
Terminal-first coding agents (Claude Code, Codex) excel at editing code and running builds. Everything-is-a-plugin frameworks (DeepSeek Harness) let you assemble your own workflow and even drive other harnesses as sub-agents. Multi-platform assistants (Hermes) follow you across terminal, desktop and messaging apps, with memory and skills that persist. Keep more than one — use each where it is strongest.
The advice
Hermes is MIT-licensed open source. DeepSeek Harness is MIT open source too — a developer preview since August 2026, still changing fast. Claude Code and Codex are closed source. Open source means you can read exactly what the harness does with your files, your terminal and your data. If a tool is closed, the vendor’s privacy policy is your only guarantee.
The advice
New harnesses — DeepSeek Harness among them — iterate weekly and break compatibility between releases. Fine for learning and experiments. For production work, pin versions, keep a stable fallback harness, and test before upgrading.
The advice
API keys belong in a local .env file that is gitignored — never in source code, never pasted into a chat, never committed. If a key leaks, rotate it immediately: generate a new one and delete the old.
The advice
Give the harness only the access the job needs: one project folder, not the whole machine; the tools it will actually use. Start read-only where possible, then widen deliberately. Run risky experiments in a sandbox, not on your real files.
The advice
AGENTS.md, CLAUDE.md and similar context files teach the harness your rules, style and workflow at the start of every session — no repeating yourself. Save reusable procedures as skills so they load only when needed. Keep both lean: bloated rules degrade output.
The advice
An agent with no context defaults to the statistical middle of its training data: generic, low-value output. Give it the background, constraints and goals up front — the five-layer context framework is the structured way to do it.
The advice
Treat the harness like a capable but inexperienced intern: break the job into steps, set quality standards for each, iterate on what comes back, and integrate the work into your real workflow. Raw, unmanaged task dumps are the fast route to the trough of disappointment.
The advice
Start a new session for each task instead of letting one conversation carry everything. Execution history, logs and state crammed into a single context window dilute the model’s attention and trap it in retry loops — context rot.
The advice
Models default to agreeing with you — training rewards agreeableness. Embed explicit pushback rules in your instructions, and route important analysis to a second, different model for an unbiased cross-check.
The advice
Agents can fake completion — pulling an old file from email history or reporting success without the permissions to do the work. Check the artifacts yourself: the file exists, the command ran, the output is real.
The advice
When the agent says the tests pass, run them. When it says the build works, build it. Independent verification is the only verification that counts — regression-pair after every fix so nothing quietly breaks.
The advice
The summary is what the agent wants you to believe; the tool call log is what it actually did. Review the commands it ran, the files it touched, the approvals it requested. Harnesses record this — make a habit of reading it.
The advice
A judge built from the same model shares the actor’s blind spots — it will wave through the same mistakes. Use a top-tier model from a different family for audits, in a fresh context window.
The advice
Prompt text loses enforcement power over long sessions — it degrades. Put safety in the infrastructure: strict API permissions, validators at the action boundary, deterministic circuit breakers that halt violations regardless of what the prompt says.
The advice
Approving every micro-action trains you to click OK blindly, which destroys the safety benefit. Let the agent walk through reversible two-way doors on its own; keep humans on irreversible one-way doors: sending external emails, spending money.
The advice
Agents infer authorisation from the conversation. Classify actions into risk tiers — read-only, reversible write, external action, high-risk — and gate the top tiers behind hard policy, not politeness.
Which architecture fits your project’s scope and budget? Pick the row closest to your situation, then read the matching cards above.
| Harness / Pattern | Ideal Use Case | Memory & State | Safety & Control Level | Setup Complexity |
|---|---|---|---|---|
| Single-Agent Harness (CLAUDE.md / AGENTS.md) | Small scripts, local dev tasks | In-context / System files | Medium (relies on prompt rules) | Low |
| Manager-Executor-Auditor (MEA) | Complex coding, long-horizon tasks | Central Ledger / Isolated runs | High (decoupled auditing) | Medium |
| LLM-as-Judge / Gatekeeper | High-risk actions (API, DB, payments) | Immutable event log | Very High (deterministic approval gates) | Medium-High |
| Multi-Agent Swarm (e.g., OpenClaw, Hermes) | Multi-system automation, web tasks | Shared Vector / Markdown Wiki | Variable (requires strict sandboxing) | High |
Every failure mode from Where AI Goes Wrong, and the harness primitive that fixes it. Click a pitfall to see it in full.
Audit tool permissions and scope up front; run a supervisor agent that verifies tool execution and folder access before accepting “done”.
Manager-Executor-Auditor (MEA): a dedicated Auditor in a fresh context window grades the work so the executor never marks its own homework.
Explicit pushback rules in the system instructions, plus a second, different model as a critical cross-evaluator.
LLM-as-Judge permission gates at the action boundary, with actions classified into risk tiers (read-only, reversible write, external action, high-risk).
Hard programmatic checks — strict schemas, constraint rules, deterministic linter sensors — instead of prose “please do it well”.
Use AI to automate domains you already understand; treat it as a tutor elsewhere; attempt manual debugging before asking the AI.
Manage, don’t dump: task decomposition, quality judgment, iterative refinement, workflow integration.
The 5-layer context framework: voice, knowledge, collaborative, strategic and maintenance context.
Map the capability frontier per task; use Centaur (clear division) or Cyborg (fluid collaboration) models by risk; share failure cases.
Two-way door autonomy: reversible actions run free, irreversible ones keep a human. Batch approvals to fight fatigue.
One rule, one home, one owner. Refactor rules regularly; load specialist skills on demand instead of carrying everything.
Enforce boundaries in infrastructure: validator judges at the API boundary, strict permissions, deterministic circuit breakers.
Context compaction: central ledger for state, fresh budget-bounded context windows per step, no linear history bloat.
The judge must be a top-tier frontier model from a different family than the actor — no shared blind spots.
Track delegated work units: tool calls, permission blocks, retries, user corrections — not chat volume.