# AI harness

> The runtime non-human work executes in - one transport for every model call, an ordered gate in front of every tool call, per-employee budgets, and a trace carrying model, prompt hash, tokens and cost

Source: https://aipril.dev/docs/harness

## What this block is

The runtime that non-human work executes in: agents and personas, the skill registry, the tool plane,
model providers, retrieval, credits, guardrails, the audit trail, memory - and, since AI employees
became subjects of the platform instead of a chat window, identity, a mandate, a position in the org
structure and an execution bridge.

It is named for what it is, not for the features it exposes. See
[AI organisation](https://aipril.dev/docs/ai-organisation.md) for the employees this runtime runs.

## The layers

```mermaid
flowchart TD
    SURF["Entry points<br/>chat, in-product panels, MCP clients, workflows"] --> SCOPE["Agent scope<br/>persona, filtered tool list"]
    SCOPE --> PIPE["Tool pipeline<br/>guardrails, then approval - fail closed"]
    PIPE --> TOOLS["Tool plane<br/>MCP tools, skills, connector bridge"]
    SCOPE --> TRANSPORT["One transport<br/>retry, classification, usage"]
    TRANSPORT --> METER["Credit metering<br/>org credits, per-employee budget"]
    METER --> PROV["Providers<br/>hosted, on-prem, OpenAI-compatible"]
    KNOW["Hybrid retrieval"] --> SCOPE
    TOOLS --> TRAIL["Audit trail and trace"]
    TRANSPORT --> TRAIL
```

## Properties worth verifying

| Question | Mechanism | Page |
|---|---|---|
| Is there genuinely one path for a model call? | Single transport, boundary test in CI, two-entry allowlist | [Invocation contour](https://aipril.dev/docs/harness/invocation.md) |
| What happens when no approver can answer? | Denied - absent, unavailable and throwing approvers all deny | [Invocation contour](https://aipril.dev/docs/harness/invocation.md) |
| Can a tool ship unclassified? | Completeness test over chat-offerable names; unknown maps to `external` | [Invocation contour](https://aipril.dev/docs/harness/invocation.md) |
| Can spend be capped per actor? | Hard monthly limit per assignment, deny-by-default, suspension | [Budgets](https://aipril.dev/docs/harness/budgets.md) |
| Is a decision reconstructible? | Model id, prompt hash, tokens, cost, latency, attempts - both paths | [Trace](https://aipril.dev/docs/harness/traces.md) |
| How is one organisation kept out of another? | Schema-per-organisation, everything in this block scoped to it | [Multi-tenant](https://aipril.dev/docs/harness/built-for-a-platform.md) |

## The pages

- [Agents that act, not guess](https://aipril.dev/docs/harness/agents.md) - the business view: cloud or on-prem with your
  own models, a set of specialised agents instead of one chat, and what "acts" means concretely.
- [The invocation contour](https://aipril.dev/docs/harness/invocation.md) - one transport, metering composed over it, the
  ordered tool pipeline, declared risk, resolved configuration.
- [Built for a multi-tenant platform](https://aipril.dev/docs/harness/built-for-a-platform.md) - schema-per-organisation
  isolation, registry-level integration, agents as subjects in the org structure.
- [Models and providers](https://aipril.dev/docs/harness/models-and-providers.md) - provider matrix, model registry,
  per-agent overrides, per-turn token profile, rate limits.
- [Transcription](https://aipril.dev/docs/harness/transcription.md) - speech to text as a model type: routing, metering in
  seconds of audio, and a provider policy that keeps audio inside by default.
- [Skills](https://aipril.dev/docs/harness/skills.md) - one registry, four execution kinds, organisation-authored skills,
  marketplace access enforced at dispatch.
- [Tools and MCP](https://aipril.dev/docs/harness/tools-and-mcp.md) - MCP in both directions, the connector bridge,
  per-caller authority, progressive disclosure, agent-to-agent.
- [Data scanning and retrieval](https://aipril.dev/docs/harness/knowledge.md) - the seven-step scan, query patterns and
  business rules, four layers including what agents learn, hybrid retrieval fused by rank.
- [The decision trace](https://aipril.dev/docs/harness/traces.md) - record contents, both execution paths, denials,
  redaction.
- [Budgets and metering](https://aipril.dev/docs/harness/budgets.md) - metering with no bypass, per-employee limits,
  suspension, cost per staffing unit.
- [Privacy and on-prem](https://aipril.dev/docs/harness/privacy.md) - what stays inside the contour, provider choice, and
  self-hosted sizing with hardware tiers.

## On the roadmap

Kept here so the pages above describe only what runs today.

- **Prompt versioning** - a template id and version per prompt module, alongside the content hash the
  trace already records.
- **A session log as the source of model context** - an append-only log the message history is derived
  from, making replay and forking structural.
- **Provider fallback chains** - a second provider taking over mid-request. Held deliberately: which
  model may substitute for which, and who is billed, is a product decision, not a resilience
  setting.
- **Attribution of interactive turns to an employee assignment**, matching the background paths.
- **Vendor signing and self-serve submission** for the skills marketplace.