Light harnesses and heavy ones

Harnesses come in a few common patterns. A chat app is a light one: it builds the context, keeps the conversation and may add search or memory. A coding agent is a heavy one: it can read a whole project, edit files and run commands, looping until a task is done. Other patterns sit between and around these two. The list gives each pattern first, then an example as of October 2026. Features move between products often, so the patterns last longer than the examples.

• Chat app. Adds instructions, memory, search, file uploads and connections to other apps. Example: the Claude app, with web search, projects, memory and connectors;¹²³⁴ ChatGPT.⁵
• Agentic workspace. Plans and works through many steps on a separate computer kept apart from yours, asking before some risky actions. Example: Claude’s agentic capabilities (introduced as Claude Cowork), which Anthropic’s help center says run tasks in an isolated environment on its servers.⁶⁷
• Browser. Reads web pages and acts on them. Example: Claude in Chrome, a browser extension that can read a page and navigate it.⁸
• Coding agent. Reads a codebase, edits files, runs commands and tests. Example: Claude Code, which can edit files and run commands,⁹ and OpenAI’s Codex, which works in a programmer’s terminal.¹⁰
• Inside other tools. An agent inside software people already use, often with a choice of model. Example: GitHub Copilot;¹¹ Cursor, whose agent edits files and runs terminal commands.¹²
• Self-hosted. Runs on a server you control, and you pick the model. Example: Hermes Agent, an open-source AI agent from Nous Research that, the project says, works with many model providers.¹³

Spot it today: ask of any AI tool you use, what can it touch, and when does it ask me first? The answers tell you which kind of harness it is.

An illustration, not a real case: an HR manager has two AI tools at work. One is a chat app her company allows for drafting; the other is an assistant built into the hiring system. She asks each the two questions. The chat app can touch only what she pastes in, and it asks nothing, because it can do nothing outside the chat. The hiring assistant can read every application in the system and, if its builders allow it, send messages to candidates. That second tool is the one to check before she relies on it. What a tool can touch decides what it could get wrong on her behalf, and when it asks decides whether she sees the mistake first.

One request, two harnesses

Here is a worked example. It was written for this page; it is not a real case, and it describes typical designs, not any one product’s current behavior. A teacher keeps a folder for a unit: lesson plans, worksheets, a quiz and a few duplicates. She types the same request into two tools built on the same model: “Organize my unit folder and write a summary of what’s in it.” Figure 7.2 sets the two side by side.

In the chat app, the context builder can add only what she pastes or uploads. The app can’t reach the folder on her computer, so there is nothing to approve. The model reads the files she uploaded and writes advice on how to arrange them, plus a summary of those files. The loop runs once. The done check is simple: a reply was written.

In the agentic workspace, she first chooses the folder, and the harness puts a copy in its sandbox, a separate computer the company runs, kept apart from hers. Now the loop runs many times. The model asks for a list of the files; the tool router runs that request and adds the list to the context. The model asks to make subfolders and move files, and each result comes back as text. When it wants to delete the duplicates, the permissions job stops and asks her. When the summary is written, the done check ends the run. She gets back a sorted copy of the folder and a summary.

The model was the same both times. What changed was what each harness let it see and do, and when it had to ask. That is the difference between a tool that gives advice and a tool that does the work.