The Company Harness

For all of corporate history, the number of actors inside a company topped out at the number of people it employed. Every decision, every email, every change to a system traced back to a person. That ceiling has gone. An organization running AI agents now has more actors than people, often many more, and each of them works at a speed and scale no person matches.

Most of the machinery we use to govern companies still assumes the old ceiling. Permissions, training, policy documents, quarterly reviews: all designed for actors who have common sense, get tired, and do things one at a time.

The industry is starting to call the answer AI agent governance. The interesting question is what governance means when the actors outnumber the people.

The short version

• AI agent governance is the set of rules, controls and enforcement that decides what an AI agent can see and do inside an organization. Written policy is the input; the working system is that policy enforced automatically in the agent’s path.
• The control we have always relied on is common sense, and an AI agent does not have it. A well-intentioned agent cannot tell which of four plausible readings of a request you would call a disaster.
• Start with the policy you already have. Anything written down for SOC 2, GDPR or an AI security governance framework can be enforced in software as a check the agent has to pass.
• The rules you could not foresee get learned one failure at a time, the way knowledge bases grew. Run the five-whys, find the general rule behind the specific failure, write it back.
• Red teaming your own AI agents brings those rules forward. Point internal agents at your own systems and every attempt that gets further than it should becomes a rule.
• I call the place those rules live the company harness. If AI agent governance is the discipline, the harness is the artifact you build, grow and run.

A simple request, catastrophically wrong

Someone in marketing notices the customer names on the website don’t match the CRM. They say to an agent: these don’t match, can you fix this please? Assume the agent is a normal one for 2026, something like Claude or ChatGPT wired into the website, Salesforce and Google Drive through the Model Context Protocol (MCP), with the same access the person asking has.

The agent could do what they meant, which is spot that two logos belong to ex-customers and swap them out. It could decide the website is the official list and delete every CRM record that isn’t on it. It could fail to reach the CRM and invent plausible names, because that seems better than failing. Or it could pull customers out of the CRM who never agreed to be public, and publish them.

The agent is well-intentioned, well-equipped, and has no idea which of those outcomes you would call a disaster. Common sense is the control we’ve always relied on, and it’s the one thing we can’t assume anymore. Add the speed problem - the damage one person can do in a CRM in a day is small, and an agent can do a hundred times that in a tenth of the time - and the old machinery starts to look thin.

Laid out against each other, every control we built for people fails for a different reason:

Control	What it assumes about a person	Why it does not hold for an AI agent
Permissions	Access granted is access used sparingly, and in context	Access granted is access used fully, immediately, on every record it reaches
Training	The actor remembers guidance and applies judgment to novel cases	An agent can be told the guidance and still be talked past it
Review cycles	Damage accumulates slowly enough for a quarterly look to catch it	A quarter of damage lands in an afternoon
Intent	A person who does not understand a request asks a follow-up question	An agent picks the most plausible reading and acts on it
Scale	Headcount caps the number of actors	Actors are provisioned in seconds and outnumber the people

That table is the whole argument for AI agent security being a different discipline rather than the old one applied harder. It is also where this essay parts company with the definitional question of what agent governance is. Naming the controls an agent needs is the tractable half. The hard half, and the rest of this piece, is where the rules come from once you have run out of policy to enforce.

Where AI agent governance starts: the policy you already have

If your company has any written policy at all, you have a starting point for governing agents. A policy that exists on paper can be enforced in software: customers marked as not cleared for publicity never flow anywhere public, and an agent that tries has to survive a check it can’t talk its way past.

Most companies have more of this written down than they think. A SOC 2 control set, a GDPR record of processing, a data classification policy, the retention rules in an MSA: all of it is policy that already says what may go where. The frameworks arriving specifically for AI say the same thing at a higher altitude. The NIST AI Risk Management Framework and ISO/IEC 42001 describe how to run the management system, and the EU AI Act sets obligations for higher-risk uses. None of them will tell you whether this customer may be named on your website. That part was always yours to write, and now it is yours to enforce at machine speed.

Written policy only covers what you’ve foreseen. The harder question in AI agent governance is what to do about everything you haven’t.

Grow it the way knowledge bases grew

There’s a precedent for building something no one can specify upfront. Knowledge bases were never designed top-down. They grew, gap by gap: someone needed information that wasn’t there, so they added it, and the next person found it. Over years, that organic accretion became the thing that runs the company.

I think the same pressure is about to produce a corollary on the control side. Something goes wrong. The company notices, runs the five-whys, and finds the general rule behind the specific failure. We published a customer who never signed off - so every customer gets marked, cleared or not cleared, and a policy now triggers whenever an uncleared name heads somewhere public. The rule goes in. The next failure teaches the next rule.

I’ve started calling the place those rules live the company harness. The term came out of a conversation inside Metomic, and I haven’t heard anyone else use it - maybe it sticks, maybe something better comes along. It fits because it mirrors what a harness does for an AI model today: it establishes the deterministic guardrails and abilities inside which the model exercises its freedom. A company harness is the same thing at organizational scale - the set of rules, guardrails, and machinery that keeps the organization on track when the organization includes actors that never sleep.

If AI agent governance is the discipline, the harness is the artifact: the thing you build, grow, and run.

Red teaming your own agents

Growing the harness failure by failure is the baseline. Security practice suggests we can do better, because it solved this problem a long time ago: don’t wait for attackers to find your gaps, pay people to attack you first.

Agents make that affordable at the level of the whole company. Internal agents, told your guardrails and given the same access your real agents have, probe for what could go wrong - including trying to talk other agents into doing something harmful under the guise of legitimate work. It’s probably easy to get customer information somewhere public; let’s try. Watch what the target agent does. Every attempt that gets further than it should becomes a rule you write before reality writes it for you.

Running drills like that safely requires the same harness you’re testing: requests observed in transit, actions that can be caught before they land. This sits at the jagged frontier - it half-exists, and it isn’t established practice yet. Frontiers move. I’d rather be the company that ran its first drill in 2026 than the one that reads about the technique in a 2028 incident report.

Governance that enforces itself

The end state is a harness nobody has to remember to use. This essay started as a recorded conversation, and there’s a transcript of it sitting in Google Drive. If something in that transcript shouldn’t be visible to the whole company, the harness notices at the moment of saving, splits the file, and tells the two people involved in Slack where the sensitive part went. Nobody asked. Nobody reviewed a queue. The rule existed, so the machinery applied it.

That’s the shape of the thing: policy you’ve written, enforced automatically; rules you couldn’t foresee, learned from failures and drills; the whole of it running continuously across every actor, human or not.

Companies are becoming more organic than they’ve ever been - more moving parts, more autonomy, more actors than people. The ones that get the next decade right will govern their agents deliberately: automate the policy they already have, add a rule every time reality surprises them, and probe their own edges before someone else does. That’s the harness. Start growing it now.

Key takeaways

• The number of actors inside a company no longer stops at the number of people it employs. The permissions, training and review cycles built for the old ceiling assume common sense, which is the one control an AI agent does not have.
• Start with the policy you already have. Anything written down can be enforced in software, so an agent has to pass a check rather than be trusted to use judgment.
• The rules you could not foresee get learned one failure at a time. Run the five-whys, find the general rule behind the specific failure, and write it back into the harness.
• Red teaming your own AI agents brings those rules forward, including probing whether one agent can be talked into harmful work by another. It sits at the jagged frontier and is not established practice yet.
• This is the control-side companion to the discovery problem of shadow AI: knowing which AI tools and agents are in use is what makes it possible to govern what they can see and do.