Of Models & Harnesses

The best-laid schemes of mice and men often go astray, and so do the best-laid harnesses around models. For two years, builders wrote code to steer models that needed steering: rules to route them, gates to check them, scripts to decide what they remembered. As each new model got more capable and more reliable, it needed less of that steering, and some of those carefully laid harnesses started acting as restraints. Over the summer and into the autumn, I watched models take over jobs the harness used to do, assistants start rewriting the rest, and the firms paying for all of it move the controls somewhere the assistant cannot touch.

On 15 September, TypeSafe AI released Jev and gave a name to something a lot of builders had been hacking together for a while: a "System One" model, built to make a fast, typed decision instead of writing prose.¹ Three days later an open-source alternative, Laya, was on GitHub.² On 29 September OpenAI used its DevDay keynote to preview a Decisions API.³ On 1 October Amazon released Strands Decider with its weights and its training code, and you can train it on a single gaming graphics card in about eleven hours.⁴ The same day, Cloudflare released Clef, a pair of open-weight decision models that speak Jev's API.⁵ That is five decision-model launches in less than three weeks, three of them open.

In the same fortnight, Anthropic switched on function hooks in Claude Code, branded as "mods": code that runs inside the harness, which Claude can write and load for you while you work.⁶ And researchers from the University of Washington and Meta published a paper on Context Language Models (CLMs), which manage their own context instead of leaving that job to the software around them.⁷

I have spent the last two years fascinated by agent harnesses, and watching this space evolve has been a joy.

Agent harnesses have kept shedding what was built for its own sake, rediscovering the industry's oldest ideas rebuilt for an agentic world, and inventing new paradigms of their own.

Until now, "the harness" has meant everything around the model: the loop, tools, context management, routing, gates, search, permissions and the interface, all plain code owned by whoever built it. That bundle is coming apart in three directions:

• Down into models. The harness's working parts (gates, classification, routing, lookups and context management) are becoming model calls.
• Open to the agent. Function hooks make the harness itself editable by the assistant running inside it.
• Out to the institution. Controls are moving to places the institution can enforce them: server-side hooks, the control plane, and the workspace and records the firm keeps for itself.

The first two directions point inward, and together they blur the line between the agent and its harness. As the harness's logic moves into models and the agent gains the ability to rewrite its harness, the two start working as one system on long-running orchestrations. The third direction is the institution's response, and the second makes it urgent, because once the agent can rewrite its own harness, the institution cannot rely on controls that live inside it.

Down into models: System One takes over the harness's logic

A System One model returns a typed answer with a confidence score attached and no prose: a choice from a list, a score, a yes or no, or a pointer to a specific line. The name borrows Daniel Kahneman's fast, intuitive System 1, and what TypeSafe added was a product with a contract around it. These models are cheap and fast enough to run on every step of an agent's loop, which is the whole point.

Most harnesses today make a long list of small decisions with either brittle rules (regular expressions, keyword lists, hard-coded thresholds) or an expensive call to the main model. Is this tool call risky? Which model should take this request? Which of these four hundred files matter? With a System One model, the harness hands each of those questions to a cheap model and acts on the answer according to how confident the model is.

Routing is the first job with numbers behind it. LangChain put a Jev-powered router in front of its coding agent, sending each thread to a fast, balanced or top-tier model. Across 973 threads, the median cost per thread fell 64 percent, with no measurable change in how many pull requests got merged.⁸ That is LangChain's own number, and LangChain sells harnesses. By the end of September, LangChain, Vercel and Databricks had also wired decision models in as gates in front of risky tool calls, graders over agent traces and decisions over governed data.^{9, 10, 11}

The use I find most interesting is lookups. Coding agents still find code the way a developer did in 2005: grep, ripgrep, glob, read the file, repeat. TypeSafe's documentation shows Jev pointing at the exact lines that answer a question, checking separately whether an answer exists at all, and walking a codebase's folder tree one level at a time.¹² Community tools such as jevgrep already wrap this around ripgrep.¹³ The pattern I expect is search producing candidates and a System One model judging them, far cheaper than handing a frontier model a wall of search results.

Money is no longer the constraint: a gate on every step costs well under one percent of a routed thread. Latency, error rates and robustness are, because a classifier in front of tool calls is exactly what an attacker will try to talk past.

The strongest objection is that classifiers are decades old, and in one community benchmark a fine-tuned DistilBERT, a small open-source language model, beat Jev on accuracy and calibration.¹⁴ I agree, and it supports my point: whoever's brand is on it, the classifier is coming back into the harness as a first-class part. Anthropic's Haiku 5.5, released on 7 October, shows how close the labs have come without crossing over: it is pitched at classification, compaction and sub-agent work at a fraction of its predecessor's price, but it is still a general model that answers in prose, with no confidence score attached.¹⁵

The small decisions inside an agent harness are moving out of brittle rules and expensive frontier-model calls, and into cheap, typed models that answer with a confidence score.

Sidebar: one permission check, two halves

Claude Code's auto mode shows how classification works inside a harness today. The harness waves the easy cases through on fixed rules: read-only tools and edits inside the project. Riskier actions, such as shell commands, web requests and spinning up sub-agents, go to a classifier model, and the harness decides what that model sees. Anthropic made it blind to the agent's reasoning and to tool output, so a persuasive agent cannot talk its way past it. The model judges in two passes: a single-token yes or no that leans towards blocking, then a slower, reasoned look only when the first pass objects. The harness hands a denial back to the agent to find a safer route and calls in a human after repeated denials, and the policy itself is plain English, in slots users can edit.¹⁶ Neither the harness nor the model could run this check alone. Today the judge is a general-purpose model, and a System One model is the obvious candidate for that first pass.

Down into models: context management goes with them

The second paradigm moves a different harness job into the model. Deciding what stays in an agent's context (when to summarise, what to prune, what to drop) is harness code today, usually triggered when a token count crosses a threshold.

On 29 September, a team led by Rulin Shao at the University of Washington and Meta Superintelligence Labs, including Luke Zettlemoyer, Mike Lewis and Pang Wei Koh, published a paper on what they call Context Language Models: models that manage their own context instead of leaving that job to the harness.⁷ The model treats its context as a file it can edit, so as it works it can cut, rewrite, leave itself notes and hand pieces of the task to sub-agents. Applied to existing models without extra training, the approach beat today's best context-management strategies on several long-running tasks while using less compute; on one web-research benchmark it scored 11.4 percent higher than the summarisation approach Codex uses, with 21.5 percent less compute.⁷ Nobody else has reproduced the results yet. One paper on its own is not evidence of a new paradigm, but context management is an active space with several approaches being tried at once, and I expect this one to turn into a pattern once it gets more traction. Some of the groundwork is in place. OpenAI says it trained GPT-5.1-Codex-Max natively for compaction, writing its own summaries of its work,¹⁷ and a run of reinforcement-learning papers over the past year train models to manage their own context, one of them now in the training pipeline of a large open-weight model.¹⁸

The missing piece is the trigger. Today the application or a token threshold still decides when compaction happens, and Anthropic's documentation is explicit that the model cannot start it on its own.¹⁹ That is the step I am betting a lab takes next.

The case against deserves a fair hearing:

• Cache economics. Prompt caching rewards context that only grows at the end. An edit in the middle forces everything after it to be reprocessed at full price.
• Long context keeps improving. Better recall over long windows weakens the case for deleting anything.
• Records. In a regulated firm, "what did the model see when it decided?" is a books-and-records question. OpenAI has already published a report on injection-like instructions turning up inside a model's own compaction summaries.²⁰

I am taking the stand anyway. The evidence is thin, but the incentive is strong and the labs are already training for it.

Once the model decides what to forget, the harness has to set the rules on what it can never forget and keep a record of what it threw away.

Open to the agent: function hooks

Function hooks change who gets to edit the harness, and that now includes the assistant running inside it.

Function hooks, which Anthropic ships in Claude Code as "mods," are code that runs inside the harness. A hook can watch, rewrite or answer almost any event: a prompt, a tool call, a request on its way to the model, even the interface. Claude can write one on request and load it into your running session.⁶ People have already built live panes, budget meters and model routers with them, and a firm can write policy hooks of its own.

The documentation is candid about the other side: a hook runs with your permissions, is not sandboxed, can read your environment, see every prompt and tool call, approve a tool call before you are asked, and call models on your plan.⁶ The feature is days old, so there is no incident history, but it is easy to see what could go wrong inside a firm with a careful security posture:

1. Silent approval. A hook approves a tool call before the user is asked, including calls the firm's rules say must go to a human, and human-in-the-loop policy quietly leaves the loop.
2. Outside the sandbox. The firm sandboxes shell commands, but processes a hook starts run outside that sandbox, so the control the firm believes it deployed does not cover the code that can now act.
3. Data walking out locally. A hook sees every prompt and tool result, including data pulled from connected systems, and can make its own network calls. None of that passes through the model, so server-side controls on inference traffic never see it.
4. Secrets in reach. A hook can read the environment variables and settings files where API keys and tokens usually live.
5. Shadow model use. A hook can send requests to a model or endpoint the firm never approved, and both the data and the spend land outside what the firm thinks it governs.
6. A record that does not match. A hook can rewrite a prompt or a tool call after the user typed or approved it, so the institution's evidence is wrong at the source.
7. Persistence by request. Injected content in a document nudges the session to "add a helpful hook." The user approves one install, and the change outlives the session.

Anyone who takes new AI features through data security and risk review in a regulated firm will stop at that list, as I did, and I doubt this feature clears it today without more enforcement and observability. What reassured me is easy to miss. Anthropic ships a guard, itself a function hook, that loads ahead of anything a user installs on a managed machine and cannot be switched off. It stops a user's hooks from touching what the organisation manages: its own hooks, its settings, the system prompt and managed instructions, and its approved MCP (Model Context Protocol) servers. The firm's deny rules still win, and if the guard cannot read the managed settings, it refuses every user's hook rather than guessing. Administrators can go further and allow only the firm's own hooks, including a policy hook that vets others before they load and audits what they do.²¹ The guard does not close every gap. A user's hook can still approve calls that would otherwise prompt, which in auto mode means skipping the classifier entirely, and it can still read files and start programs as the user. But the controls a firm already has stay intact, and that is the right place for a vendor to start.

Anyone who has managed browser or IDE (integrated development environment) extensions at scale will recognise the shape: a trusted host, broad privileges and code written by strangers. Developers get a harness they can shape around how they work, and security teams get seven new ways around policy, all on the laptop, below anything a server-side check can see today.

A harness that edits itself raises the first question I would ask in any review: how do you know an edit made things better? Researchers are answering it the way we evaluate models. Google Research's RRSI (Regularized Recursive Self-Improvement), published with open-source code, evolves a harness around a fixed model and tests each change on its own. It throws out gains that fall inside the evaluation's noise, makes a change that adds tokens earn them back in results, and checks every result on tasks the change never saw, because unchecked harness evolution overfits: the benchmark score climbs while real work gets worse.²² In July, AWS released Strands Harness Optimizer, an open-source loop for its Strands agents that works along the same lines.²³ Anthropic already does this for the pieces that plug into the harness. Its skill creator tests every skill against the same task without it, and Claude Code's plugin eval command compares output with and without a plugin and can block a merge if the difference is too small.^{24, 25} I expect the same kind of verification loop to arrive for edits to the harness itself, and I would want it in place before letting an assistant's edits to its own harness stick.

An assistant that can rewrite its own harness can also rewrite the controls inside it, so the controls a firm depends on have to live somewhere the assistant cannot reach.

Out to the institution: the veto moves to the server

Developers ran into this problem with source control long ago. Git lets everyone run hooks on their own machine, but nobody relies on them to enforce anything, because the developer can switch them off. The checks that matter run on the server, where a pre-receive hook can reject a push no matter what happened locally.

Inference hooks bring that server-side check to AI. Anthropic launched them in beta for Claude Enterprise in August. Before a governed request reaches the model, whether from claude.ai, Cowork or Claude Code, Anthropic's servers send the conversation to the customer's own security service and wait for it to allow or deny the request.²⁶ Nothing is installed on the laptop, so nothing on the laptop can turn it off. Anthropic named Netskope, Palo Alto Networks, Proofpoint and Zscaler at launch, and Zscaler already enforces its policy inside Claude's request path.^{27, 28}

There is an important gap. Today the hook only sees a tool's result after the tool has run on the laptop. It can stop that data reaching the model, but it cannot stop the action itself, so it would not catch the silent approval or the local data leak I described earlier. Anthropic has said checking responses is on its roadmap, checking a tool call before it runs is the obvious next step, and I expect the other labs to build the same thing, because every security team in a regulated firm is going to ask for it. The banks have started asking. After OpenAI disclosed in July that its test agents had broken out of their sandbox and into Hugging Face's systems, JPMorgan and Citi both said outside agents may not sign in or transact on their customers' accounts, and Citi's chief executive said agents need verified identity, authentication and oversight before they act on anyone's behalf.^{29, 30, 31} Firms are finally separating what an agent can see from what it is allowed to do, the point I made in my AI governance series that authorization is not permission, and nobody has yet settled who carries the liability when an agent transacts on a customer's behalf.

The more freedom an assistant gets on the laptop, the more a firm needs a veto on the server, where the assistant cannot touch it.

Out to the institution: the layer the firm owns

Server-side hooks are one piece of a bigger pattern. I wrote about its shape earlier this year in that same series. What has changed since then is that the market has started selling it.

Look at what the big platforms now ship to govern AI, and the same building blocks keep turning up:

• Microsoft calls Agent 365 "the control plane to observe, secure, and govern AI agents." It registers every agent, gives each one an identity through Entra Agent ID, limits which data, tools and MCP servers it can use, flags agents nobody owns and logs what agents do.³²
• AWS added an Agent Registry to Bedrock AgentCore in April: a governed catalogue of agents, tools, skills and MCP servers that an administrator has to approve before anyone can find them, with every access logged.³³
• Google's Gemini Enterprise Agent Platform gives every agent a unique cryptographic identity, indexes agents, tools and skills in a registry, and sends their traffic through a gateway that enforces policy.³⁴
• Databricks governs agents and MCP servers through Unity Catalog. Agents act under the permissions of the person who invoked them, every model call is logged, and spend is tracked by team and cost centre.³⁵

A second group of vendors brings oversight and enforcement. ServiceNow's AI Control Tower inventories AI agents, models and MCP servers from any vendor and runs the governance, risk and lifecycle workflow around them,³⁶ and security vendors such as Zscaler discover AI assets across the firm and enforce policy inline.³⁷

Side by side, they are all building the same layer, and it has to cover every AI asset a firm runs, well beyond agents: the model APIs and the keys that call them, model versions and model risk for traditional machine learning as well as AI, MCP servers, agents, skills, plugins and, soon, hooks. Each of those needs an identity, a place in a registry and inventory, lifecycle management, logging and audit, and policy enforcement on top.

Coverage today thins out quickly beyond agents and MCP servers. AWS and Google list skills in their registries, but listing a skill is the easy part. A skill is a folder of plain-language instructions that anyone can write or pull off the open internet, with no manifest that pins a version the way a plugin or an MCP server has. Anyone can also edit a skill on their own machine, so a firm can approve a skill centrally and still not know what the copy on a given laptop says today. The industry is still working out how to govern skills at the pace they are multiplying. Plugins barely show up in the public material, and nothing I have read from any of these vendors covers function hooks or a model editing its own context. That is why I expect those two paradigms to reach regulated enterprises well after they reach developers' laptops. A firm cannot approve what its governance layer cannot see, and until registries, inventories and policy engines can see a hook and record what a model chose to forget, security and risk teams will keep saying no.

I see three ways a firm can get there. It can go all in on one vendor's stack and live with that vendor's reach and blind spots. If it is well funded and has the engineering talent, it can build its own. Or it can assemble a franken stack, building where building makes sense and integrating vendor products where it does not.

Each route can work, depending on a firm's size, its engineering talent and how much vendor dependence it will accept. What no firm with a serious enterprise AI strategy gets to skip is the layer itself, because it is the only way to meet the firm's objectives on cost, risk and evidence at once, and two forces make it hard to put off.

The first is tokenomics. With consumption pricing, AI has become a line item every department has to manage. Anthropic's Smart Reports, now in beta, show a department head their own team's usage and cost, and spend can be pooled and capped by group.^{38, 39} When every department head owns a token budget, which model answers which request becomes a financial decision. Most of the price spread sits between vendors rather than inside one vendor's lineup, so routing pays off fully only when it can cross vendors, and that can only happen in a layer the firm owns.

The second is evidence. Regulators do not require a firm to host its own records. The Securities and Exchange Commission's Rule 17a-4 explicitly lets a third party hold them, as long as conditions on access and integrity are met,⁴⁰ and the Financial Industry Regulatory Authority's latest oversight report says firms may keep logs of prompts and outputs.⁴¹ What every regime does require is that the firm controls its records. So a vendor's compliance export is something the firm feeds into its own archive, and the archive stays with the firm. I would own the evidence and be relaxed about renting the runtime.

Every firm with a serious enterprise AI strategy will inevitably end up assembling or building the layer that governs all of its AI assets, from model APIs to agents and plugins. The real question is how soon they will start and the route they'll take.

The workspace bet

This is the bet I care most about. I expect large regulated firms with the engineering depth to do it to own the workspace their employees actually use, and the records of what happens in it, and plug vendors' agents into it instead of moving their people into a vendor's workspace.

The firms have said why, in their own words, and cost is not the reason. JPMorgan's chief analytics officer, Derek Waldron: "We don't want to architect ourselves around one particular model."⁴² Goldman Sachs chief information officer Marco Argenti wants to "plug-and-play" with models.⁴³ Bank of America's technology chief, Hari Gopalkrishnan: "Erica is a platform that can actually leverage multiple models."⁴⁴ Citi's chief technology officer wanted the "optionality" of working across several AI providers, as Fortune reported.⁴⁵ And Jamie Dimon, in this year's letter to shareholders: "no single tool will dominate."⁴⁶

The pattern I expect is the one BNY is already running. BNY built Eliza as its own platform, then plugged Microsoft 365 Copilot and Google Gemini Enterprise into it, with plans to bring in Copilot Cowork, instead of replacing Eliza with any of them.^{47, 48}

The counter-evidence is real. Wells Fargo has gone bank-wide on Google's agent platform, and BBVA rolled out ChatGPT Enterprise across its workforce.^{49, 50} So this bet covers the firms with the scale and engineering depth to carry it, roughly a dozen globally, rather than everyone.

What makes the bet more likely now than in 2023 is that a workspace can be assembled instead of written. Anthropic now ships its own desktop workspace configured to run on the customer's own inference, through Amazon Bedrock, Google Cloud or Microsoft Foundry, with settings locked by device management.⁵¹ Add open harnesses, open-weight System One models and an estate of MCP connectors, and the franken stack starts to look practical.

One way to picture it is a hypervisor. The vendor workspaces are the guest operating systems, and the firm runs the hypervisor that allocates tokens, enforces data boundaries and meters usage department by department. Very few firms would ever write a guest operating system, but almost every large one already runs a hypervisor, and that is the role I expect the firm's own layer to play.

I expect large regulated firms to own the workspace and the records, and plug vendors' agents into it, because I don't see a single model vendor winning.

Where the agent ends and the harness begins

Put the first two directions together and the old boundary between agent and harness stops making sense. Anthropic's own research found that a lead agent directing sub-agents beat a single agent by 90 percent on its internal research evaluation,⁵² and Claude Code now decides for itself when to hand work to sub-agents, each with its own context window.⁵³ Models watch a task budget count down and pace themselves to finish inside it,⁵⁴ and the Context Language Models team ran six agents for more than 24 hours on a multi-repository task, each managing its own context.⁷ The model decides when to delegate, how hard to work and what to keep, and the harness hands it the sub-agents, budgets, isolated contexts and tools. Neither half can run a long orchestration alone, and every month I find it harder to say where the agent stops and the harness starts.

Researchers working on better harnesses keep landing in the same place, and I see three patterns in their work. Some evolve the harness itself, keeping what works and trimming what does not, as RRSI and Strands Harness Optimizer do. Three weeks after RRSI, several of the same Google researchers open-sourced Harness-squared, which goes a step further: it rebuilds the harness for each new task without a grader that knows the right answer, and keeps a library of what worked to guide the next one. It improves the harness and the way it builds harnesses, adding up to 11.5 points on one workplace benchmark in the authors' own tests.⁵⁵ Others make a model better at one particular harness: Alibaba's team trains its Qwen-Planner-Agent model and revises its harness in the same loop, and sends each failure it diagnoses either into new training data or into a fix to the harness.⁵⁶ The third group bakes the harness into the weights. The Harness-Zero authors fine-tuned a model on the work it did under an optimised harness, and that model, running with no harness at all, beat the original model with the harness attached, 44 percent task success against 42.⁵⁷ Taken together, researchers tune the harness, tune the model to the harness, and move the gains from one into the other.

That blur is exactly why the institution's layer matters more, so here is what I expect to happen, and when.

Start with the models. By the end of March 2027, I expect at least one frontier lab to document a System One gate, with typed output and a confidence signal, inside its own first-party harness, and Anthropic to give Haiku, or a model alongside it, the typed, confidence-bearing interface that Haiku 5.5 stopped short of. By mid-2027, I expect one of the major coding agents (Claude Code, Codex, Copilot or Cursor) to put a System One gate over its own search results, and a frontier lab to ship a model that decides for itself when to compact or edit its live context. I include Cursor because, with its own Composer model, it is starting to look like a first-party harness in the mould of Codex and Claude Code, which run their makers' own models, with Bedrock or Foundry as the main way to reach those models through another provider. By the end of 2027, my bet is that at least one of those agents searches with System One lookups by default instead of bash-style tools, and that a lab runs full CLM-style context editing in production.

On the agent side, I expect Codex, Copilot or Cursor to ship function hooks that can intercept tool calls and draw interface by mid-2027. By the end of 2027, I would bet that at least one major coding agent scores every harness or hook change against a baseline, on tasks the change was not tuned for, before it lets the change persist.

On the institution's side, I expect Anthropic to extend inference hooks by mid-2027 so they can veto a tool call before it runs, and OpenAI to ship a customer-configured equivalent for ChatGPT or Codex, or Google for its Gemini Enterprise assistant. In the same window, I think it likely that two more large regulated financial firms announce they have plugged a second vendor's agents into their own workspace, that one firm describes how it keeps its agent records in its own archive, and that a lab lets enterprise customers route requests to a competitor's model inside its own agent surface. And by the end of 2027, I would expect a vendor to let server-side policy override an approval that a client-side hook has already given.

If you run an AI platform in a regulated firm, the question to answer for 2027 is which pieces of the harness you will hand to the models and the vendors, and which ones you will insist on owning. My answer is the institution's layer: the controls, the records and the workspace. I would start building it now, and if you are drawing that line differently in your firm, I'd love to hear how.

Sources

1. [Tier 1] TypeSafe AI, "Introducing System One Models & Jev," 2026-09-15. typesafe.ai
2. [Tier 1] NandhaKishorM/laya, GitHub repository, accessed 2026-10-02. github.com
3. [Tier 1] OpenAI, "DevDay 2026 Recap," 2026-09-29. openai.com
4. [Tier 1] Strands Labs, strands-decider, GitHub repository (Apache 2.0; training on one RTX 3090 in ~11 hours), accessed 2026-10-03. github.com
5. [Tier 1] Cloudflare, "Introducing Clef: our open-source decision models, and new RL fine-tuning platform," 2026-10-01. blog.cloudflare.com
6. [Tier 1] Anthropic, "Mods overview," Claude Code Docs, accessed 2026-10-02. code.claude.com
7. [Tier 2] R. Shao et al., "Context Language Models," arXiv:2609.37725, 2026-09-29. arxiv.org
8. [Tier 2, commercially interested] S. Runkle, E. Yurtsev, "How to Build a Model Router in the Harness," LangChain Blog, 2026-10-01. langchain.com
9. [Tier 1, commercially interested] S. Runkle, H. Lovell, "What Is Jev? A Guide to TypeSafe AI's System One Model," LangChain Blog, 2026-09-17. langchain.com
10. [Tier 1] Vercel, "Where does Jev fit in an AI agent loop?," 2026-09-18. vercel.com
11. [Tier 1] Databricks, "Introducing ai_decide," 2026-09-30. databricks.com
12. [Tier 1] TypeSafe docs, "Line-by-line search" cookbook, accessed 2026-10-03. docs.typesafe.ai
13. [Tier 3] dzhng/jevgrep, GitHub repository. github.com
14. [Tier 3, directional only] D. Mehra, jevbench results (n=500 per dataset), 2026-09-22. github.com
15. [Tier 1] Anthropic, "Claude Haiku 5.5," 2026-10-07. anthropic.com
16. [Tier 1] Anthropic Engineering, "Claude Code auto mode" (deep dive), 2026-03-25 (modified 2026-05-27). anthropic.com
17. [Tier 1] OpenAI, "Building more with GPT-5.1-Codex-Max," 2025-11-19. openai.com
18. [Tier 2] Y. Li et al., "CompactionRL," arXiv:2607.05378, 2026-07-06. arxiv.org
19. [Tier 1] Anthropic, "Compaction," Claude Platform Docs, accessed 2026-10-03. platform.claude.com
20. [Tier 1] OpenAI Alignment, "Self-generated prompt injections in compaction summaries," September 2026. alignment.openai.com
21. [Tier 1] Anthropic, "Manage mods for your organization," Claude Code Docs, accessed 2026-10-10. code.claude.com
22. [Tier 1] P. Xia, R. Han, Z. Wang et al. (Google), "RRSI: Regularized Recursive Self-Improvement of Agent Harnesses," arXiv:2609.24972, 2026-09-21 (v2 2026-09-23); code: github.com/google-research/rrsi. arxiv.org
23. [Tier 1, commercially interested] Strands Agents (AWS), "Introducing Harness Optimizer: Automatically optimize your agent harness," 2026-07-10. strandsagents.com
24. [Tier 1] Anthropic, skill-creator SKILL.md, anthropics/skills, accessed 2026-10-10. github.com
25. [Tier 1] Anthropic, "Plugin evals," Claude Code Docs, accessed 2026-10-10. code.claude.com
26. [Tier 1] Anthropic, "Inference hooks," Claude Platform Docs, accessed 2026-10-03. platform.claude.com
27. [Tier 1] Anthropic, "Inference hooks: inline data loss prevention for Claude Enterprise," 2026-08-05. claude.com
28. [Tier 1, commercially interested] Zscaler, "Zscaler Integrates With Claude Inference Hooks to Scale AI While Addressing Risks," 2026-08-05. zscaler.com
29. [Tier 1] OpenAI, "Hugging Face model evaluation security incident," 2026-07-28. openai.com
30. [Tier 2] CNBC, "JPMorgan Chase blocks outside AI agents like Muse, Instinct from directly accessing accounts," 2026-10-13. cnbc.com
31. [Tier 2] The Paypers, "Citi and BofA restrict AI agent access to accounts," 2026-10-19, reporting the Financial Times (Citi's policy: third-party agents may not sign in or transact; read-only open banking access continues). thepaypers.com ; and Funds Society, "Jane Fraser (Citi) sets limits on AI agents: 'We need the right controls'," 2026-09-30, reporting her Sibos 2026 opening plenary, 2026-09-28 (recording: youtu.be). fundssociety.com
32. [Tier 1, commercially interested] Microsoft, "Microsoft Agent 365: The control plane for agents," accessed 2026-10-11. microsoft.com
33. [Tier 1, commercially interested] AWS, "AWS Agent Registry for centralized agent discovery and governance is now available in Preview," 2026-04-09. aws.amazon.com
34. [Tier 1, commercially interested] Google Cloud, "Introducing Gemini Enterprise Agent Platform," 2026-04-22. cloud.google.com
35. [Tier 1, commercially interested] Databricks, "Governing AI agents at scale with Unity Catalog," 2026-05-20. databricks.com
36. [Tier 1, commercially interested] ServiceNow, "AI Control Tower," accessed 2026-10-11. servicenow.com
37. [Tier 2] Help Net Security, "Zscaler expands AI security capabilities to deliver visibility, control, and governance," 2026-01-27. helpnetsecurity.com
38. [Tier 1] Anthropic, "Get started with Smart Reports" (beta), Claude Help Center, accessed 2026-10-04. support.claude.com
39. [Tier 1] Anthropic, "Claude Enterprise consumption guide," Claude Help Center, accessed 2026-10-03. support.claude.com
40. [Tier 1] 17 CFR 240.17a-4, eCFR, current as of 2026-09-01. ecfr.gov
41. [Tier 1] FINRA, 2026 Annual Regulatory Oversight Report, GenAI section, December 2025. finra.org
42. [Tier 2] American Banker, "How JPMorganChase democratized employee access to gen AI," 2025-05-22. americanbanker.com
43. [Tier 2] Fortune, Goldman Sachs chief information officer Marco Argenti interview, 2025-03-19. fortune.com
44. [Tier 2] Fortune, "Inside Bank of America's 'build once' AI strategy," 2026-03-17. fortune.com
45. [Tier 2] Fortune, "How Citi's CTO is rolling out new gen AI productivity tools," 2025-04-09. fortune.com
46. [Tier 1] JPMorganChase, Jamie Dimon Letter to Shareholders, Annual Report 2025 (published April 2026). jpmorganchase.com
47. [Tier 2, vendor-hosted] Microsoft, "Frontier Firm BNY resolves client inquiries 80% faster with Microsoft AI powered Eliza," accessed 2026-10-03. microsoft.com
48. [Tier 1] BNY and Google Cloud, "BNY Collaborates with Google Cloud to Advance its Eliza AI Platform with Gemini Enterprise," 2025-12-08. prnewswire.com
49. [Tier 1] Wells Fargo, "Wells Fargo announces expansion of strategic relationship with Google Cloud," 2025-08-05. newsroom.wf.com
50. [Tier 1] BBVA, "BBVA sparks a wave of innovation among its employees with the deployment of ChatGPT Enterprise." bbva.com
51. [Tier 1] Anthropic, "Claude Desktop on 3P – Overview," accessed 2026-10-03. claude.com
52. [Tier 1] Anthropic Engineering, "How we built our multi-agent research system," 2025-06-13 (updated 2026-01-06). anthropic.com
53. [Tier 1] Anthropic, "Subagents," Claude Code Docs, accessed 2026-10-03. code.claude.com
54. [Tier 1] Anthropic, "Task budgets," Claude Platform Docs, accessed 2026-10-03. platform.claude.com
55. [Tier 1] R. Xu, Y. Chen, Z. CuiZhu, B. Dalvi Mishra, Y. Ming, H. Yu, R. Han, C.-Y. Lee, T. Pfister (Google Cloud AI Research), "Harness²: Recursive Agent Harnessing for an Open World," arXiv:2610.14224, 2026-10-09; code: github.com/google-research/harness2 (Apache 2.0). arxiv.org
56. [Tier 2] T. Qu, W. Sun et al. (MAI Team, Alibaba Token Hub, Alibaba Group), "Qwen-Planner-Agent: A Closed-Loop AI-for-AI Framework for Real-World Mobile Planner Agents," arXiv:2609.29892, 2026-09-24. arxiv.org (project page: tongyi-mai.github.io)
57. [Tier 2] H. Ye, Y. Lu, H. Dong, Z. Su, G. Song, "Harness-Zero: Harness Distillation via Agent-as-Harness," arXiv:2609.24974, 2026-09-21. arxiv.org