Harness Engineering for Auditable Enterprise LLM Agents

Joongho Ahn and Moonsoo Kim submitted an arXiv paper on 9 Jul 2026 that lays out a harness-engineering approach to turn prompt-driven prototypes into auditable enterprise LLM agents. The authors instantiate the pattern on a public-data slice covering five Korean corporate groups (25 listed companies) and run a structured evaluation across multiple models and failure modes.

What does the harness do?

The harness moves deterministic behavior out of prompts and into code, manifests, schemas, and validation artifacts so runtime answers remain source-backed and auditable. The paper says deterministic aspects are codified around a replaceable composition boundary, while source-backed claims remain the authority for answers; validators and manifests enforce source boundaries, entity routing, answer contracts, and reproducible traces.

How was the harness evaluated and what were the results?

The authors evaluated three research questions on a public-data slice of five Korean corporate groups (25 listed companies), running validation scenarios and fault-injection controls to measure source-grounding, entity-routing, trace, output-hygiene, and recommendation-language contracts. The harness preserved its contracts across the fixed validation scenarios; a fault-injection control confirmed the validators flagged deliberately broken contracts. The checks also held under model substitution: across three hosted models, they passed on all 270 composition-boundary runs, with any failures confined to the model-composed side and caught and recorded. Holding the model fixed and varying enforcement, prompt instructions alone let recommendation-language and internal-trace-leakage violations reach the reader, which the harness blocks entirely. A bolt-on external guardrail also prevented such violations but over-refused, reducing utility to 88/120 where the harness preserved full utility at 120/120. The paper spans 32 pages and includes 6 figures and 16 tables, with a reference implementation and evaluation artifacts linked in the submission.

Why it matters

The pattern separates what must be code-ensured from what can remain model-driven, so enterprises can get reproducible traces and explicit contracts without relying on fragile prompt engineering. The evaluation shows those code-owned guarantees are load-bearing: enforcement implemented in the harness prevented leakage and policy violations that prompting alone did not, and avoided the over-restriction observed with a bolt-on guardrail while preserving maximum utility in the tested scenarios.

What to watch

Look for the authors' reference implementation and evaluation artifacts that accompany the paper; the submission includes those materials and they will be the practical test for adoption. Also watch whether the harness pattern is applied beyond the paper's five-group, 25-company public-data slice and replicated across other datasets and production LLMs.

References and data points cited from the paper: submission date 9 Jul 2026; public-data slice of five Korean corporate groups (25 listed companies); three hosted models, 270 composition-boundary runs; utility 120/120 for the harness versus 88/120 for a bolt-on external guardrail; 32 pages, 6 figures, 16 tables.