Authoritative guidance caught up with the architecture
The UK DSIT AI Risk Management Toolkit puts risk ownership, treatment decisions and multidisciplinary review into the operating model. The important Harness consequence is a reviewable risk record tied to the actual use case—not a generic model classification.
The Australian Signals Directorate / ACSC publication Agentic AI Harnesses is more direct: the layer above the model shapes security, governance, reliability and operational risk. That supports assessing and protecting the harness separately from the model, because tools, permissions, state, policy and evidence accumulate there.
ENISA's CRA Single Reporting Platform launch turned regulatory reporting into an operational pipeline. Reporter role, awareness time, deadline state, submission approval, authority acknowledgement and closure evidence should be preserved as one governed record.
Tool exposure and runtime behavior are part of model behavior
When Tools Get in the Way found that merely making an unnecessary tool available could reduce answer correctness, even when the tool was rarely invoked. The architectural implication is stronger than tool authorization: model-facing tool exposure itself needs relevance admission and regression testing.
Ecdysis argues that harness evolution should react to recurring cross-task failure patterns rather than patch every isolated failure. That supports failure clustering, diagnosis and gated harness change instead of model-specific scaffolding that silently accumulates technical debt.
PARSER supports parallel reading with deeper synthesis. It fits the existing rule of distributed cognition with centralized decision authority: specialists can gather evidence in parallel, while synthesis and consequential decisions remain explicitly controlled.
Reference implementations hardened the execution boundary
OpenAI Agents Python 0.22.1/0.22.2 and the MCP Python SDK 2.2.0 added stronger guardrail coverage, sandbox isolation, approval-state integrity, redirect restrictions, session limits and stricter OAuth validation. These are implementation signals, not universal requirements, but they reinforce fail-closed execution and identity-bound tool use.
OrcaReplay added agent-native events for starts, handoffs and guardrails. The evidence lesson is important: a proxy cannot reconstruct every material event. Native harness telemetry and network/tool telemetry need to be correlated, with coverage gaps declared rather than assumed away.