On 11 September 2026 the Australian Signals Directorate published a short paper for boards and security leaders called Agentic AI harnesses: the layer above the model. Its argument fits in one sentence: you don't control the model, you control everything wrapped around it, so that is where governance has to live. We read it twice. Once as people who work in this industry, once as the people who build one of the eleven components it names. Here is what it says, and an honest account of where a recorder fits.
Brain and body
ASD's picture is simple. The language model is the brain: it reads what is put in front of it, reasons about it, and proposes the next step. The harness is the body: it decides what the brain sees, holds memory between turns, runs the tools, calls the APIs, and enforces the permissions. The brain only produces text. The body is what acts.
Two things follow, and the paper is blunt about both. First, the model is a replaceable part. A well-built harness will outlive several generations of models, so the harness is where the long-term investment accumulates, and the long-term risk with it. Second, most of the failures that hurt an organisation happen at the join. A model can propose deleting a file. Whether the file is deleted is the harness's decision. When an agent misbehaves, ASD says, look at the harness configuration, not just the prompt.
The weakness that can't be patched
The paper's sharpest point is about prompt injection. A model is handed instructions and information in the same context window, and it cannot reliably tell them apart. A web page, an email, a comment in a code file: any of it can read as a command. ASD states plainly that no fully reliable technical fix exists for this inside the model, and that the mitigation therefore has to sit in the harness. Limit what the agent can reach. Limit what it can do. Watch what it did.
That last clause is the one we care about, because a control you cannot show an auditor is a control you cannot prove was switched on.
Eleven components, one of them ours
ASD breaks the harness into eleven components: the user interface, the prompt and policy layer, the context manager, the model interface, the tool registry, the permission system, the execution environment, the connector layer, the memory and session store, audit and observability, and the update and supply-chain path. It calls this list "the organisation's configuration surface". Most of what you can practically control about an agent is a setting in one of these boxes.
Ten of them are yours to configure, whether you build the harness or buy it. The eleventh, audit and observability, ASD defines as the component that "records activity for monitoring, review and incident response". That is Wytness. Not the harness, not the model: the record of what the body did, held somewhere the body cannot reach.
The paragraph we build
Under "good practice" the paper has one paragraph about records, and it is worth quoting whole:
Record prompts, responses, tool invocations, approvals, actions, security events and configuration changes. Protect, retain, review and independently monitor logs to support auditability, security monitoring, incident response, investigations and accountability.
Take it a clause at a time.
Prompts, responses, tool invocations, actions. Every event on the tape carries the tool that ran, the parameters it was given, the prompt, the response, and how it ended. Personal data inside that text is replaced with tokens before the event leaves your process, under a key you generate in your browser and we never hold, so we can record the conversation without being able to read the people in it. The pseudonymisation post walks one field through the whole journey.
Approvals. When an action was gated through AGT's approval primitive, the event records that it was approved and by whom. If your harness didn't gate the action, there is nothing to record, and the record says so rather than implying otherwise.
Security events. AGT's governance events land on the same tape as the tool calls. On top of them, seven anomaly rules run continuously against your history: a tool an agent has never used before, a spike in call frequency, a jump in error rate, restricted data being touched, activity outside working hours, a break in the hash chain, and an agent acting outside the capabilities it was registered with.
Configuration changes. Here we are precise. Wytness records what your harness emits. If your harness logs its own configuration changes as events, they are on the tape. If it doesn't, we don't see them. We record what the body did, not its settings file.
Protect. Each event is hash-chained by AGT and signed with your key, not ours. Alter one and the chain shows it. Tamper-evident is the honest word for that, and it is the word we use.
Retain. The record is held for as long as you are a customer, in an archive under a seven-year lifecycle rule. When you leave, you receive sealed Evidence Packs of everything before it is deleted. Retention that ends when the relationship ends, with the evidence in your hands, not ours.
Review. Dashboards for the people who run agents. Evidence Packs mapped to SOC 2, ISO 27001 and the EU AI Act for the people who audit them. Export for everyone else.
Independently monitor. This is the clause a harness cannot satisfy on its own. A log held inside the harness is a log the harness can edit. Wytness holds the record outside it, on an open standard anyone can verify without asking us, and pushes alerts into the tools your security team already watches: Microsoft Sentinel, Splunk, ServiceNow, Slack, or a plain webhook. Why we chose an open standard over our own format is its own post.
Cost is a security signal
One line in the paper will surprise people who file cost under finance. Agent sessions cost far more than a chat exchange, and ASD recommends watching that spend for "runaway agent loops or denial-of-wallet attacks". We agree. Every captured model call is priced the moment it arrives, every agent can carry a budget, and a sudden spike in call frequency raises an alert before the invoice does.
Where a recorder stops
A good paper deserves a straight answer about what we don't do.
- Least privilege. ASD's first recommendation is a hardened environment with only the tools and permissions the task needs. That is a harness setting. Registry shows the permissions each agent actually exercised, which is the evidence a least-privilege review needs. It does not restrict anything.
- Human approval. ASD wants sensitive actions to wait for a person. Shield today lets you write those policies and rehearse them against your own history in observe mode. Enforcement, and routing an approval to a human, are on the roadmap. Until then your harness's own approval hook does the gating, and we record its verdicts.
- Prompt injection. We detect the shape of it: an agent acting outside its registered capabilities, a new tool appearing, restricted data moving. We don't prevent it, and ASD is clear that nothing reliably does.
- Context hygiene, rules files, checking output before it's used. Yours, entirely. The paper's advice on all three is good, and we have nothing to sell you for it.
Seven questions for the board
The paper closes with seven questions directors should ask. Here is how a recorder helps with each, and where it doesn't.
- What business outcome is this agent for, and why an agentic approach? Yours.
- What data, systems and tools can the agent access? Registry answers what it did access: every agent, tool and permission seen on the tape.
- What actions can it perform, and which need human approval? The tape answers the first half. The second is a harness policy; Shield rehearses it today and will enforce it later.
- How is prompt injection mitigated? Partly in your harness, partly by AGT's runtime checks, and the anomaly rules catch the symptoms.
- Can all significant decisions, tool invocations and actions be monitored and audited? Yes. This question is the product.
- How will we know it is delivering value, operating safely and within risk tolerance? Dashboards, anomalies and spend cover the safety and tolerance halves. Value is yours to measure.
- If the harness were compromised, what is the worst outcome? Yours to answer. The answer is a great deal better when the record of what happened sits outside the thing that was compromised.
The harness changes. The record shouldn't.
The paper points readers on to the UK National Cyber Security Centre's work on prompt injection, and its harness framing is vendor-neutral. It will travel. Its central claim, that the harness is the durable investment and the model is the swappable part, is also the reason we built the recorder as a separate layer on an open standard rather than inside any one harness. A harness will be rebuilt, swapped and upgraded. The record of what it did should survive all of that, and be readable by someone who never trusted the harness in the first place.
Read the paper. Then ask of your own harness which of the eleven boxes you could show an auditor tomorrow, or let Preflight score them from the tape. Questions about the one we build? Ask us.