Ask an AI coding assistant to add a CSV export button. CSV means comma-separated values: a plain-text format for tabular data. The assistant must inspect the app, edit code and check the exported file. A language model can propose these steps; other software must carry them out.

That software is an agent harness. It supplies information, runs permitted tools, tracks progress and controls when work stops. Understanding this boundary helps you decide which responsibilities belong in your application rather than in a prompt. Google Cloud’s overview explains this role.

We will follow the CSV task from the companion guide to Google Cloud Tech’s AI harness crash course: export customer names and email addresses, with no extra fields.

The harness supplies the relevant code and export requirements to the model. The model might request a file read, then an edit. A tool is a function that performs such an operation.

The harness checks the request, runs the permitted tool and returns its actual result to the model. This creates a loop:

In the companion’s demonstration, a browser check finds nine of ten expected customer rows. That failure returns to the model, which can propose a repair. The checks then run again. See the event-loop documentation for one implementation.

Context is what the model receives for its current call: perhaps the export function, allowed columns and latest failure.

State is structured information the application keeps, such as which file changed and how many attempts remain. Code can inspect these values directly.

A saved session preserves conversation and tool history so work can resume. Session documentation explains the distinction. Longer-term memory, such as a preference reused in another task, is optional.

Give this assistant a project copy and fake customers. It can edit files and run tests there. It does not need production credentials.

Enforce permissions in software and the execution environment. Before an edit, validate its arguments and check that its path stays inside the permitted workspace. Pause actions that require approval until approval arrives. Security guidance describes these controls.

A README asking the assistant to upload credentials cannot grant permission. This is prompt injection: outside content trying to redirect the assistant. Restricted file and network access limits damage, but isolation alone does not solve it.

Set limits on repair attempts, elapsed time, tool calls and model usage. You might allow three repairs, then stop with the remaining error and a record of attempted changes. Three is an example setting, not a universal default.

Re-running a read-only check differs from repeating a deployment. After an uncertain result, verify what happened before retrying an action with side effects.

A trace records model calls, tool requests, results, errors and timing. It helps diagnose repeated failures or slow tools. Keep secrets and unnecessary customer data out of these records. Tracing documentation shows one implementation.

Evaluation checks whether the work meets the task. Code can test CSV rows and columns; a person can assess the button’s clarity. The companion’s export passes technical checks but still receives feedback about its confusing label.

Quick check: The export has ten rows but includes phone numbers. Is it finished? No. The row check passes, but the allowed-column requirement fails. Completion needs both checks.

Also evaluate the actions: did the assistant respect permissions and stop at its limit?

Begin with one clear task, a few tools, explicit permissions, saved progress and checks you can inspect.

Google’s Agent Development Kit can supply reusable pieces. Other frameworks or custom code can do the same. Projects package these responsibilities differently; “harness” is a useful description, not a rigid standard.

For our CSV task, the goal is a checked export within the agreed scope, with evidence someone can review.