Three dominant themes inthe discussion
| Theme | Summary | Representative quote |
|---|---|---|
| 1. Sandboxing & credential isolation are non‑negotiable | Many commenters stress that any code the agent runs must execute inside its own sandbox, and secrets must never live inside that sandbox. They argue for separate sandboxes for tool execution, memory, and the agent itself to limit blast radius. | “But shouldn't there really be another sandbox where the agentic tool calls execute? This is to contain the damage of the tool execution when it goes wrong.” — saltcured “Yes, it's also because the agent described in the post is doing some operations on the user code… you don't want credentials or anything trusted inside that sandbox.” — shad42 |
| 2. The “harness” needs a clear definition | The term harness is used inconsistently. Several users provide their own concise definition and point out the confusion with “agent” vs. “harness”. This theme highlights the need for shared vocabulary. | “My definition is: you take an agent, remove the model and you’re left with the harness.” — aluzzardi “Ever since Mitchell Hashimoto mentioned the harness in February, people have been trying to claim that concept.” — jdw64 |
| 3. Placement of the harness (inside vs. outside the sandbox) and permission scoping | Opinions diverge on whether the harness should run inside the same sandbox as the agent or outside it, and how to enforce access control. The consensus leans toward an external, permission‑checked harness that routes requests appropriately. | “Regarding scoping… the LLM is just another API client using a slightly different format for inputs and outputs, but sharing the same permission layer.” — aluzzardi “If the harness is outside the sandbox then it’s just an ambiguous and confusing security model and boundary.” — MrDarcy |
All quotations are reproduced verbatim with double‑quotes and proper author attribution.