Australia's Signals Directorate published guidance on September 11 specifying what belongs in the infrastructure wrapping an AI agent — the "harness," in their language. Eleven components, from permission systems and sandboxed execution environments to audit logging and supply-chain update paths. If you've ever written a runbook for production systems, the shape is familiar.
What's worth paying attention to: ASD treats the model itself as a replaceable part. The harness is the organizational investment that persists across model upgrades, and the place where security controls actually live. Prompt injection can't be reliably solved inside the model, so you solve it outside — least privilege, human approval gates for high-impact actions, cost monitoring as a security signal.
ASD also includes seven governance questions for boards, starting with whether the system needs to be agentic at all. And a useful caveat: no harness is inherently secure. You still defend in depth.
ASD's eleven harness components:
- User interface — where humans see agent activity and intervene
- Prompt and policy layer — standing instructions and business rules
- Context manager — what the model sees (and can therefore leak)
- Model interface — which models the harness may call, with what parameters
- Tool registry — available tools and their declared functions
- Permission system — which actions require approval before execution
- Execution environment — where actions run and how failures are contained
- Connector layer — attached data sources and enterprise systems
- Memory and session store — what persists between sessions, including stale or poisoned content
- Audit and observability — what gets recorded and can be investigated after the fact
- Update and supply-chain path — how new capability arrives, and the risk it carries
ASD frames these as configuration choices — the organization's primary decisions about what an agent can and cannot do.