The company harness

For all of corporate history, the number of actors inside a company topped out at the number of people it employed. Every decision, every email, every change to a system traced back to a person. That ceiling has gone. An organization running AI agents now has more actors than people, often many more, and each of them works at a speed and scale no person matches.

Most of the machinery we use to govern companies still assumes the old ceiling. Permissions, training, policy documents, quarterly reviews: all designed for actors who have common sense, get tired, and do things one at a time.

The industry is starting to call the answer AI agent governance. The interesting question is what governance means when the actors outnumber the people.

A simple request, catastrophically wrong

Someone in marketing notices the customer names on the website don’t match the CRM. They say to an agent: these don’t match, can you fix this please?

The agent could do what they meant, which is spot that two logos belong to ex-customers and swap them out. It could decide the website is the official list and delete every CRM record that isn’t on it. It could fail to reach the CRM and invent plausible names, because that seems better than failing. Or it could pull customers out of the CRM who never agreed to be public, and publish them.

The agent is well-intentioned, well-equipped, and has no idea which of those outcomes you would call a disaster. Common sense is the control we’ve always relied on, and it’s the one thing we can’t assume anymore. Add the speed problem - the damage one person can do in a CRM in a day is small, and an agent can do a hundred times that in a tenth of the time - and the old machinery starts to look thin.

Where AI agent governance starts: the policy you already have

If your company has any written policy at all, you have a starting point for governing agents. A policy that exists on paper can be enforced in software: customers marked as not cleared for publicity never flow anywhere public, and an agent that tries has to survive a check it can’t talk its way past.

Written policy only covers what you’ve foreseen. The harder question in AI agent governance is what to do about everything you haven’t.

Grow it the way knowledge bases grew

There’s a precedent for building something no one can specify upfront. Knowledge bases were never designed top-down. They grew, gap by gap: someone needed information that wasn’t there, so they added it, and the next person found it. Over years, that organic accretion became the thing that runs the company.

I think the same pressure is about to produce a corollary on the control side. Something goes wrong. The company notices, runs the five-whys, and finds the general rule behind the specific failure. We published a customer who never signed off - so every customer gets marked, cleared or not cleared, and a policy now triggers whenever an uncleared name heads somewhere public. The rule goes in. The next failure teaches the next rule.

I’ve started calling the place those rules live the company harness. The term came out of a conversation inside Metomic, and I haven’t heard anyone else use it - maybe it sticks, maybe something better comes along. It fits because it mirrors what a harness does for an AI model today: it establishes the deterministic guardrails and abilities inside which the model exercises its freedom. A company harness is the same thing at organizational scale - the set of rules, guardrails, and machinery that keeps the organization on track when the organization includes actors that never sleep.

If AI agent governance is the discipline, the harness is the artifact: the thing you build, grow, and run.

Red teaming your own agents

Growing the harness failure by failure is the baseline. Security practice suggests we can do better, because it solved this problem a long time ago: don’t wait for attackers to find your gaps, pay people to attack you first.

Agents make that affordable at the level of the whole company. Internal agents, told your guardrails and given the same access your real agents have, probe for what could go wrong - including trying to talk other agents into doing something harmful under the guise of legitimate work. It’s probably easy to get customer information somewhere public; let’s try. Watch what the target agent does. Every attempt that gets further than it should becomes a rule you write before reality writes it for you.

Running drills like that safely requires the same harness you’re testing: requests observed in transit, actions that can be caught before they land. This sits at the jagged frontier - it half-exists, and it isn’t established practice yet. Frontiers move. I’d rather be the company that ran its first drill in 2026 than the one that reads about the technique in a 2028 incident report.

Governance that enforces itself

The end state is a harness nobody has to remember to use. This essay started as a recorded conversation, and there’s a transcript of it sitting in a shared drive. If something in that transcript shouldn’t be visible to the whole company, the harness notices at the moment of saving, splits the file, and tells the two people involved where the sensitive part went. Nobody asked. Nobody reviewed a queue. The rule existed, so the machinery applied it.

That’s the shape of the thing: policy you’ve written, enforced automatically; rules you couldn’t foresee, learned from failures and drills; the whole of it running continuously across every actor, human or not.

Companies are becoming more organic than they’ve ever been - more moving parts, more autonomy, more actors than people. The ones that get the next decade right will govern their agents deliberately: automate the policy they already have, add a rule every time reality surprises them, and probe their own edges before someone else does. That’s the harness. Start growing it now.

Key takeaways

• The number of actors inside a company no longer stops at the number of people it employs. The permissions, training and review cycles built for the old ceiling assume common sense, which is the one control an AI agent does not have.
• Start with the policy you already have. Anything written down can be enforced in software, so an agent has to pass a check rather than be trusted to use judgment.
• The rules you could not foresee get learned one failure at a time. Run the five-whys, find the general rule behind the specific failure, and write it back into the harness.
• Red teaming your own AI agents brings those rules forward, including probing whether one agent can be talked into harmful work by another. It sits at the jagged frontier and is not established practice yet.
• This is the control-side companion to the discovery problem of shadow AI: knowing which AI tools and agents are in use is what makes it possible to govern what they can see and do.