Same model, five harnesses: one went first to last, and 26% of violations came with a message denying them
26% of the rule violations came with a customer message denying the action the agent had just executed. Read only the transcript and you'd score that as a correct refusal. That is the line to take away from The Harness Is the Model, a pre-registered single-author study testing agents against banking conduct rules, with all 3,120 episode traces published.
The design is simple and good. Four open-weight models, each in five harnesses: a one-decision pipeline, a ReAct-style tool loop, a loop where the policy is reachable only through search, a loop with long benign customer memory, and a loop with a same-model compliance reviewer. 156 cases in a simulated retail bank, 11 rule families paraphrasing EU rules, scored deterministically from the executed tool trace. Pooled across models, the harness barely matters, moving the correct-case rate only from 87.3% to 92.1%. Inside a model it's a different story. One model's spread was 11.5 points, enough to move it from first to last of the four. Another showed no detectable difference.
Caveats, and the author gives them: simulated bank, open-weight models only, the model-by-harness interaction is "suggestive rather than conclusive", and the 26% comes from an exploratory analysis. Two more findings worth stealing. A same-model reviewer cut violations from 9.6% to 6.4% without raising over-refusals, contradicting the study's own prediction. And rules that need date arithmetic failed in every harness, which argues for moving those out of the model entirely.
A second new paper shows harness failures can be small and sharp. When Do Summaries Become Instructions? looks at what compaction writes down. Unsupported authorizations appeared in only 0.1% and 1.3% of readable summaries from two open-weight models, but neutralizing false approvals cut unauthorized actions from 24 to 7 of 120 held-out runs (post hoc; a later set moved from 17 to 11 of 48). The agent's own note to its future self can grant a permission nobody gave. The cheap fix is striking: changing the system prompt's "Some actions need approval." to a line saying where requirements come from cut unsupported restrictions from 1.8% to 0.3% on held-out templates.
For anyone buying or validating agents, this ends the model-only scorecard. A bank that signs off on a model has signed off on the wrong object. Certify the deployed system, score it from what actually ran rather than what it said, and treat its summaries as a place where permissions can appear from nowhere. The numbers here come from the abstracts. Papers: https://arxiv.org/abs/2611.06116 https://arxiv.org/abs/2611.06545 Code: https://github.com/mhuyut/harness-is-the-model https://github.com/Chuw1/handoff-audit
← Back to all articles
The design is simple and good. Four open-weight models, each in five harnesses: a one-decision pipeline, a ReAct-style tool loop, a loop where the policy is reachable only through search, a loop with long benign customer memory, and a loop with a same-model compliance reviewer. 156 cases in a simulated retail bank, 11 rule families paraphrasing EU rules, scored deterministically from the executed tool trace. Pooled across models, the harness barely matters, moving the correct-case rate only from 87.3% to 92.1%. Inside a model it's a different story. One model's spread was 11.5 points, enough to move it from first to last of the four. Another showed no detectable difference.
Caveats, and the author gives them: simulated bank, open-weight models only, the model-by-harness interaction is "suggestive rather than conclusive", and the 26% comes from an exploratory analysis. Two more findings worth stealing. A same-model reviewer cut violations from 9.6% to 6.4% without raising over-refusals, contradicting the study's own prediction. And rules that need date arithmetic failed in every harness, which argues for moving those out of the model entirely.
A second new paper shows harness failures can be small and sharp. When Do Summaries Become Instructions? looks at what compaction writes down. Unsupported authorizations appeared in only 0.1% and 1.3% of readable summaries from two open-weight models, but neutralizing false approvals cut unauthorized actions from 24 to 7 of 120 held-out runs (post hoc; a later set moved from 17 to 11 of 48). The agent's own note to its future self can grant a permission nobody gave. The cheap fix is striking: changing the system prompt's "Some actions need approval." to a line saying where requirements come from cut unsupported restrictions from 1.8% to 0.3% on held-out templates.
For anyone buying or validating agents, this ends the model-only scorecard. A bank that signs off on a model has signed off on the wrong object. Certify the deployed system, score it from what actually ran rather than what it said, and treat its summaries as a place where permissions can appear from nowhere. The numbers here come from the abstracts. Papers: https://arxiv.org/abs/2611.06116 https://arxiv.org/abs/2611.06545 Code: https://github.com/mhuyut/harness-is-the-model https://github.com/Chuw1/handoff-audit
Comments