The Agent Harness Turns Safety Into Switching Cost

A June 2026 survey of 101 companies found that only 6% plan to let a model vendor run the control layer self-directed agents need. Forty percent already use Anthropic’s Claude stack as their primary agent platform, more than double the next name, and still refuse to hand over the leash.

Tesla made the same tension visible in cash. An internal memo put a $200 a week ceiling on staff spending for third-party AI tools from July 6, 2026, while beta products from xAI, Elon Musk’s other AI company, sit outside the tally.

Tesla’s $200 Weekly Cap Doubles as a Vendor Funnel

The memo followed an internal push to get Tesla staff using AI more, complete with dashboards that ranked people by token burn. People familiar with usage said some software engineers had been running up thousands of dollars a week. The new rule requires manager sign-off above $200, and it covers tools from Anthropic, OpenAI, and Google. Hit the cap every week and the line is $10,400 a year before anyone asks for an exception.

People inside Tesla also said many engineers still prefer Claude over Grok for daily work. The carve-out does not argue about model quality. It changes the price of leaving the house stack. A cost control and a distribution play can be the same policy.

TESLA’S WEEKLY AI RULES

• The ceiling: $200 per employee per week on third-party AI tools, live from July 6, 2026.
• The override: Manager approval is required to spend above the line.
• The exception: Beta xAI products, including Grok and Composer, do not count against the cap.
• The prior habit: Internal dashboards ranked staff by token use after a company push to consume more AI.

That is a harness in the finance department’s language. It sets a permission, writes an audit trail, and routes work toward a favored runtime. Companies that never work at Tesla are writing the same kind of rule in software instead of in expense policy.

What an Agent Harness Controls

An agent is not a chatbot with extra manners. Anthropic’s docs define it as an application that plans its own steps and calls tools that read files, run commands, or edit code. Once those tools can update records, fire workflows, or move money, prompt filters and basic login rights are the wrong size of fence.

A harness is the software around the model: the loop, the tool list, the memory, the approval gates, and the logs. Anthropic’s Agent SDK, the library formerly shipped as the Claude Code SDK, gives builders the same tools, agent loop, and context management that power Claude Code, now callable from Python and TypeScript. It also exposes permissions, hooks, subagents, sessions, plugins, and MCP connections, which is how a team decides what may run unattended and what must wait for a person.

Microsoft’s May 1, 2026 launch note for Agent 365 put the same job in security language.

You can’t govern what you can’t see, and you can’t secure what you don’t understand, especially when the number of agents is a moving target.

Microsoft, Agent 365 general-availability note, May 1, 2026

Microsoft sells that visibility as a control plane for agents, generally available for commercial customers at $15 per user per month as a stand-alone add-on, or inside Microsoft 365 E7. Entra Agent ID, Defender, Purview, and Intune sit underneath it. The pitch is registry, identity, and kill power for agents that act on a user’s behalf and for agents that hold their own credentials.

WHAT THE HARNESS HOLDS

• Permissions: Which tools run on their own and which need a human yes.
• Tool limits: Which APIs, files, browsers, and money paths an agent may touch.
• Sequence: The order of steps, including stops for review in regulated work.
• Logs: Who did what, with which model, against which system of record.
• Spend: Caps, alerts, and a way to halt a loop that is burning tokens.

Labs now sell that bundle with the model, because a bare API call no longer matches how agents work. The performance argument is real. So is the switching cost that arrives with event schemas, identity graphs, skill stores, and eval suites that do not move when you change the weights underneath.

Most of Those Agents Are Still Chatbots

The June 2026 Pulse Research wave asked 101 companies with at least 100 staff which agent platform they use first. The answers cluster on model vendors, not on the open frameworks that dominate engineering talk. Read them as this cohort’s primary bet, not as global spend share. The sample is self-selected and buyer-heavy.

PRIMARY ORCHESTRATION BETS

Anthropic, Microsoft, OpenAI, Google, and Amazon together account for 81 of the 101 answers. Custom in-house builds sit at 5%, and 3% are not coordinating agents yet. Model gravity is the top reason for the choice, at 21%, ahead of flexibility and ease of development at 17% each.

The portfolio behind those platforms is thinner than the labels. Seventy-one percent of the same companies say a quarter or fewer of their deployed “agents” are true multi-step workflows rather than single-prompt wrappers. Only 10% have crossed the halfway mark. They judge success by task completion reliability (32%) and multi-step workflow management (28%), which is an awkward scoreboard for a fleet that is still mostly chat.

That gap is why the control plane is being built ahead of the work it is meant to run. By the end of 2026, 51% expect a hybrid setup, vendor tools plus an external layer they own. Only 6% expect a provider-managed service. Asked the risk if control lives inside a model vendor, they named vendor lock-in first, at 35%, ahead of weak security and permissions at 28%. Twenty-five percent plan to put more money into a custom in-house control plane over the next year.

The Control Plane Became a Product This Year

The labs did not wait for that survey. They productized the leash, then argued that their leash runs the model best. Anthropic’s own writing treats harness design as a discipline: decide what belongs in the scaffolding, then strip it as the model gets smarter. Claude Managed Agents, announced in April 2026, pair an Anthropic-run harness with hosted state, memory, permissions, and schedules. The company is explicit that you define tasks, tools, and guardrails, and it runs the loop.

Microsoft’s Agent 365 is the other large-company version of the same object: a registry for agents across Copilot Studio, Foundry, partner SaaS, and, in preview, local tools such as Claude Code and OpenClaw on Windows. AWS Bedrock and Google Gemini Enterprise Agent Platform show up as registry-sync targets, which is a polite way of saying the control plane wants to see rivals’ agents too.

THE CONTROL PLANE CALENDAR

1. October 16, 2025: Anthropic launches Agent Skills as folders of instructions, scripts, and resources that Claude loads when a task matches.
2. December 18, 2025: Anthropic adds org-wide skill management and published Agent Skills as an open standard for use outside Claude.
3. May 1, 2026: Microsoft Agent 365 reaches general availability as a commercial control plane at $15 per user per month, or inside Microsoft 365 E7.
4. July 6, 2026: Tesla’s $200-a-week third-party AI cap takes effect, with xAI beta tools exempt.
5. July 28, 2026: The Model Context Protocol specification dated 2026-07-28 lands, shifting MCP toward a stateless request/response core and adding a skills-over-MCP extension.

Open protocols are the hedge companies say they want. MCP is how agents reach files, tickets, and APIs without a one-off connector per model. Skills are how a company stores “how we do invoices here” as a SKILL.md folder instead of a prompt buried in one vendor’s console. The June survey still shows 68% planning to add or replace an orchestration platform within twelve months, the jumpiest layer in that research series, which is what a market looks like when the runtime is sticky and the buyers know it.

Skills Folders Travel, the Runtime Does Not

A skill, in Anthropic’s product language, is a folder. It holds a SKILL.md file, optional scripts, and reference docs. Claude scans names and descriptions, then loads only what the task needs. The company tells developers the format is portable across Claude apps, Claude Code, and the API, and that the Agent SDK uses the same skill files. That is the closest thing the industry has to the “fat skills” idea CIOs keep repeating: keep the procedure in a file you own, so a model upgrade does not force a rewrite of the business.

Portable folders do not make the loop portable. Permissions models, session stores, eval sets, and identity (Entra Agent ID on one side, Anthropic’s commercial terms on the SDK on the other) stay with whoever runs the process. Block’s Goose and other bring-any-model agents exist because that split is obvious to builders. The usual reply from people who live on Claude Code is that a closed $200 software plan can hide a large token allotment, so an “open” harness that bills API list prices can lose on the invoice even when it wins on exit cost.

Ben Mathes, a former Google colleague of the CIO-level argument this debate sits in, has been blunt about writing custom rules around whatever model is current. New foundation models keep retiring last quarter’s workarounds. The durable bet is modular instructions, fat prompts that hold company knowledge, and backends that keep data in order, so the harness can change without a full rebuild. Companies that embed that knowledge only inside a vendor console will relive the last decade of SaaS lock-in, just faster.

Twenty-seven percent of the surveyed companies still have no real-time way to stop a runaway agent before the bill arrives. That is not a model-IQ problem. It is a missing brake, and it is why procurement is moving from model bake-offs to control-system bake-offs even while 40% of this cohort standardizes on one lab.

Token Caps Arrive Once Safety Clears

Gartner’s Anushree Verma, a senior director analyst, said most agentic projects are still early experiments, often misapplied, and that hype blinds buyers to cost and complexity. The firm’s public forecast is harsher on the calendar than the vendor blogs are.

GARTNER’S AGENT FORECASTS

• Cancellations: over 40% of agentic AI projects dropped by the end of 2027, citing cost, fuzzy value, or weak risk controls.
• Software mix: 33% of enterprise applications include agentic AI by 2028, up from under 1% in 2024.
• Daily decisions: at least 15% of day-to-day work choices made by agents by 2028, up from none in 2024.
• Buyer posture: in a January 2025 poll of 3,412 webinar attendees, 19% had made significant agentic investments, 42% conservative ones, 8% none, and 31% were waiting or unsure.

Once a company clears a basic safety bar, the live problem is the one Tesla wrote into a memo: performance per dollar, with a brake. Safety, quality of work, and cost are the three questions that remain after the demo. A vendor harness can win the first two and still fail the third if every useful action is a metered token. An in-house harness can win the third and still fail an audit if it cannot say which agent changed a policy record.

The June survey’s 51% hybrid camp is the practical answer most large buyers are reaching for. Use the lab’s loop where it is ahead. Keep identity, permissions, spend caps, and the skill files where you can move them. Sixty-eight percent of those companies still expect to add or replace an orchestration platform within a year, which means the leash is already on and the contract is not.