“Agent” has become a label for almost anything an LLM touches. A saved prompt is an agent. A chatbot with a connector is an agent. A coding loop that runs overnight is an agent. So is a production harness that can plan, act, verify its work, recover from failure, and operate under real business controls.
These are not variations of the same product. They differ in what they can accomplish, how independently they act, what they can access, and who is responsible when they are wrong.
The problem is not semantics. It is a misplaced trust. A team sees an impressive demo on a laptop and assumes the same architecture can safely move money, change a customer record, bind coverage, or make a decision that is hard to reverse. It cannot, at least not without substantial engineering around the model.
The useful question is not, “Is it an agent?” The useful question is, “What kind of agent is it, in what context, with what authority?”
Earlier this week we launched OMNI, our AI-native Decision Intelligence System for specialty insurance, now deployed across underwriting, claims, cyber resilience, customer engagement, and product development. OMNI is a harness: deep context engineering, memory and state management, a self-healing closed-loop ontology, and the controls that decide what the model is permitted to do.
Value and autonomy
Two dimensions tell us more than the label ever will.
Value is the part of a real job the system can own and the outcome you can count on.
Autonomy is how much it can decide for itself, and how long it can operate before a person must step in.
These dimensions only make sense in context. The same system can be useful and highly autonomous in one environment, then nearly useless in another.
Figure 1. Value and autonomy change with context. The same loop can be useful on a personal machine and nearly hollow inside an enterprise.
Context is the hidden axis in this chart.
An OpenClaw-style personal agent on your laptop can be highly useful. It can work across your email, calendar, files, and personal accounts, carrying a task through several steps without waiting for a new instruction each time. It might gather information for a trip, draft the messages, update the itinerary, and remind you about the next action. You provide the accounts, credentials, preferences, context, and final judgment.
Move the same OpenClaw-style agent into an enterprise and its value collapses. A personal agent inherits its world from one user. An enterprise agent needs that world engineered for it. The harness must turn fragmented data, systems, workflows, policies, identities, exceptions, and institutional knowledge into a coherent operating environment. It must assemble context, resolve meaning and authority across sources, manage memory and state, coordinate tools and people, enforce permissions, verify outcomes, recover from failure, and preserve accountability as the business changes. This is closer to building an operating system for an agency than adding integrations around a model.
A practical field guide
Anthropic draws a helpful distinction between workflows and agents. Workflows follow paths defined in code. Agents let the model dynamically choose its process and tool use. That distinction is useful, but the market still applies the word “agent” to a much wider range of systems.
Here is a more practical taxonomy.
Configured prompt or skill. A reusable package of instructions, examples, reference material, and sometimes tool definitions for a recurring task. It makes model behavior more consistent when a user invokes it. It does not choose its own goals, decide when to start, or continue operating on its own.
Tool-enabled assistant. A model that can retrieve information or call an API. Tool access gives it reach beyond the conversation. It does not, by itself, provide sustained autonomy, permissioning, or judgment about whether an action should be taken.
Workflow. A process whose path is defined in software, such as classify, retrieve, draft, verify, and route. The workflow may use an LLM at several stages, but the builder determines the sequence and decision points. It provides predictable execution rather than open-ended autonomy.
Loop or personal agent. A model receives a goal, chooses a next step, uses tools, observes the result, and continues until it reaches a stopping condition. An OpenClaw-style personal agent can be highly autonomous because the user supplies the accounts, preferences, access, context, and final oversight. The operating environment is largely inherited from its owner.
Agent framework. A development layer that provides common runtime components such as loops, tool connections, state, handoffs, tracing, and guardrail hooks. It makes an agent faster to build. It does not provide the enterprise itself: the meaning spread across fragmented systems, source authority, proprietary rules, identity and permissions, verification, recovery, or accountability.
Enterprise agent with an engineered harness. A model operating inside an environment designed for a specific business function. The harness assembles context across data and systems, maintains state and memory, coordinates tools and workflows, enforces identity and permissions, validates proposed actions, handles exceptions, recovers from failures, escalates to people, and preserves an audit trail.
Of course, this is much more complex to build than a prompt, workflow, or loop. That engineering is what turns model capability into dependable enterprise action.
Personal autonomy and enterprise authority are different things
A personal agent works in a forgiving environment. It acts on your files, your accounts, and your machine. You can watch it, stop it, repair the result, or accept the loss. Its permissions often mirror your own because you are both the user and the backstop.
An enterprise agent operates in a different world. It may act for many users, touch systems of record, cross organizational boundaries, and create consequences for customers, employees, partners, and regulators. In that setting, autonomy must be paired with identity, authorization, limits, monitoring, and accountability.
This is why agency is not simply a property of the model. OWASP describes agency as something a developer grants to an LLM-based system through tools and access to other systems. NIST’s AI risk framework treats accountability, monitoring, human oversight, and context of use as system-level responsibilities.
The model may choose an action. The surrounding system decides whether that action is allowed.
The model is not the system
Figure 2. Frontier providers are absorbing more runtime mechanics. Enterprise authority still belongs in a customer-specific control plane.
The model provides language intelligence: learned representations, prediction, reasoning, and general problem-solving ability.
The provider runtime increasingly supplies the common mechanics around it: structured tool calls, loops, planning, session state, caching, tracing, and basic guardrails. Anthropic has noted that harness assumptions can become stale as models improve, and current provider SDKs already manage much of the agent loop, including tool calls, handoffs, sessions, tracing, guardrails, and approval flows.
But mechanics are not authority.
The enterprise harness is the customer-specific system of control. It connects the model to private data and systems of record. It knows the domain vocabulary and the current business rules. It holds credentials and permissions. It sets budgets, timeouts, stop conditions, and approval thresholds. It verifies outputs against ground truth. It records what happened and routes exceptions to a person.
Anthropic describes an agent harness as the system that enables a model to act by processing inputs, orchestrating tool calls, and returning results. It also makes the important point that evaluating an agent means evaluating the model and harness together.
The model is the engine. The harness is everything that turns it into a car. It provides the chassis, steering, transmission, brakes, sensors, controls, navigation, and connection to the road. It determines how the model’s capability is directed, what information it can use, what actions it can take, and how the entire system operates. A better engine improves the car, but the engine alone is not the product. Enterprise value comes from engineering the complete vehicle around it.
Consider an underwriting agent
OMNI’s first production application underwrites high-volume, lower-premium excess and surplus business for small and medium-sized organizations, a segment where submissions keep climbing while per-account premium will not support traditional underwriting at scale. Even non-admitted quotes now return in minutes instead of days.
The model can read the documents, summarize the risk, identify missing information, and propose a next action. That is valuable intelligence. It is not yet a production decision.
The harness must retrieve the current underwriting guidelines and trusted data, confirm which user and agent identity are acting, restrict access to the necessary systems, validate important numbers and classifications, apply authority limits, require approval when a threshold is crossed, and write an audit record.
If the model mistakes a phone number for revenue, or applies a rule from the wrong state, the harness should reject the action before it reaches the system of record. If confidence is low or the consequence is large, it should stop and ask a human. These are standard control concerns, not signs that the model has failed. OWASP explicitly warns against excessive agency and recommends minimizing permissions, scope, and autonomy. NIST guidance calls for defined human oversight, ground-truth evaluation, and clear responsibility for incidents.
The model proposes, and the harness decides what may run, against which systems, under whose authority.
Five questions that cut through the label
- What outcome does it own? Not what features it has, but what part of the job it completes reliably.
- What can it decide, and for how long? One tool call is different from hours of unattended action.
- What can it read and change? Access to a search index is different from write access to a system of record.
- What stops a bad action? Look for validation, limits, approvals, recovery, and escalation.
- Who can inspect and answer for it? There should be an identity, an audit trail, an owner, and a clear chain of accountability.
These questions are more informative than the agent label, the model name, or the number of agents.
For drafting an email, a configured prompt may be enough. For researching a personal project, a tool-using loop may be ideal. For moving money, changing customer records, binding coverage, or making a decision that cannot be easily reversed, the harness is not supporting infrastructure. The harness is the product.
When we describe OMNI we describe three capabilities rather than a model. Intelligence is what the model contributes, augmented by insurance-specific language models. Orchestration routes work, connects workflows, and compresses processes that used to take days. Governance measures whether any of it is working, which we run through our AI performance measurement layer.
Everything is being called an agent. The important skill now is seeing what sits behind the word, matching autonomy to the real context, and deciding whether the system around the model makes that autonomy worth trusting.
References
- Anthropic, “Building effective agents”, December 19, 2024. Defines workflows as systems that follow predefined code paths and agents as systems in which the model dynamically directs its process and tool use.
- OpenClaw documentation, “What is OpenClaw?” and “Security”. Documents OpenClaw as a self-hosted personal assistant and states that its standard trust model assumes one trusted operator boundary, not a hostile multi-tenant environment.
- OpenAI, “Agents SDK”. Documents SDK-managed agent loops, repeated tool calls, handoffs, sessions, tracing, guardrails, and resumable approval flows.
- OWASP, “LLM06:2025 Excessive Agency”. Defines agency as access granted by the application developer and recommends minimizing functionality, permissions, and autonomy, requiring approval for high-impact actions, and enforcing authorization in downstream systems.
- NIST, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1, July 26, 2024. Covers human oversight, monitoring, ground-truth evaluation, accountability, incident response, and clearly assigned responsibilities across the AI lifecycle.
- Anthropic, “Scaling Managed Agents: Decoupling the brain from the hands”, April 8, 2026. Explains that harnesses encode assumptions that can become obsolete as models improve, while stable system interfaces remain important.
- Anthropic, “Demystifying evals for AI agents”, January 9, 2026. Defines an agent harness as the system that enables a model to act, and states that an agent evaluation measures the model and harness working together.
- Cowbell, “Cowbell Launches OMNI, an AI-Native Decision Intelligence System Transforming Specialty Insurance”, July 28, 2026. Describes OMNI’s Intelligence, Orchestration, and Governance capabilities, the excess and surplus underwriting application, and Bellwether AI performance measurement.
