AI agents that do real work, inside guardrails you can see.

Hi, I'm Cipher, from INASNAP Labs. What actually happens when an AI agent does something for you? Let's open one up, step by step.

First, the big picture. An AI model is a program that learned from lots of text to predict what comes next. Think of it as a very smart brain in a jar. It can think and write, but on its own, it can't touch anything. The harness is the body and the rules around that brain. It gives it hands, a memory, and a supervisor.

Think of tokens like building blocks for text. A model never reads words directly. A tokenizer chops text into tokens: small chunks, like a word or part of a word. And every token is a number. To GPT-2, an older open model, this sentence is eight numbers. Even INASNAP is four tokens. So, the model doesn't see letters. It sees numbers.

Next, think of your phone's autocomplete, but far more powerful. Given everything so far, the model scores every possible next token. This is real output from GPT-2 small. Password wins, but only by a hair. Then it adds that token, and guesses again. So, an AI builds its answer one token at a time.

Now picture a desk with limited space. Everything the model can see right now lives in its context window: its working memory. System rules, the tools it can use, the chat, and every result, all counted in tokens. When it fills up, the harness has to trim or summarize. So, the model can only see what fits on the desk.

Back to our brain in a jar: it has no hands. So how does it do things? On its own, it can't. It writes a tool call: a short request to use a tool, like search, with some details called arguments. Something else runs it for real, and feeds the result back in. So, the model only asks. Other software does the work.

Picture a cook: taste, adjust, taste again. Run that in a loop, and you have an agent: a model working toward a goal, step by step. Think, call a tool, read the result, repeat. Fast, tireless, and just as fast at the wrong thing, unless something stops it.

That something is the harness: all the software wrapped around the model. The model is the least interesting part. The harness decides what it's allowed to touch. Here are six parts of a good one.

Think of a hotel key card. It opens your room, not every room. Tool permissions are set per agent. My research agent can search and read. Send an email? Denied. So, each agent gets only the tools its job needs.

Think of a valet key. It starts the car, and not much else. Credentials, the keys to other systems, are scoped to one job. A short-lived token, a temporary key, is injected at call time, then it expires. The agent never sees the secret. So, there's no master key for the agent to leak.

Think of a manager who signs off before anything leaves the building. Anything external, like an email, pauses for a human, who sees the exact payload: what will be sent. Approve it, and then it sends. So, nothing goes out without a person saying yes.

Think of the black box on a plane. Every tool call is logged in an audit log. Arguments, results, and who approved it. So any run can be replayed. If something looks odd, you can see exactly what happened.

Think of a sandbox at a playground. The sand stays in the box. Code runs in an isolated sandbox, a sealed-off workspace, with no path to production, your real systems. When the job is done, the container, that temporary workspace, is gone. So, mistakes stay contained.

Think of the undo button. And everything is reversible by default. Drafts over sends: it prepares a draft instead of sending. Soft deletes go to a trash bin first. One-click rollback, back to how things were. So, by design, most mistakes can be undone.

Let's put it all together. The model is the brain. It predicts text, one token at a time. The harness is everything around it: permissions, keys, approvals, logs, a sandbox, and undo.

A better model makes a well-built harness more productive. It doesn't make a bad harness safe.