The Harness Problem: Why Agentic Delivery Stalls Between the Demo and Production

Microsoft's 28 October 2026 post argues that competing on AI means being multi-model, and that drawing value from multiple models requires a harness solving for performance, quality and cost. Google's Gemini 4 Carbon, published the same day, is described as its strongest model, emphasising cybersecurity and long-horizon work, and is being released in stages: a subset of cyber defenders first, then trusted partners through its Fairwind Program, with wider access promised as soon as possible. Google published vendor-stated benchmark scores and launch pricing of $2 per million input tokens and $10 per million output tokens. This analysis names the buyer pain point behind stalled pilots: non-determinism that breaks test confidence, per-run cost that arrives after deployment, and permissions cloned from human roles rather than scoped to tasks. It sets out seven decision criteria, compares building against adopting a harness, and details a 30-day evaluation.

Ask a delivery team what changed this year and the answer is consistent. They can produce agents faster than they can prove one is safe to release. That gap, not model quality, is where enterprise AI programmes now sit.

The pain point: a fluent demo is not a delivery process

Application code is predictable. Run the same test against the same build twice and you get the same result. That predictability is what makes continuous integration, automated gates and release approvals meaningful rather than ceremonial.

Agents do not behave that way. The same agent, given the same input, can select a different tool or take a different path on the next run. A test that passed yesterday tells you very little about tomorrow.

This changes what a buyer can ask for. You cannot request a passing test suite for a system whose behaviour is not fixed. You have to ask a different question: what evidence can this system produce about what it just did, and who signed off before it acted?

What Microsoft published on 28 October

Microsoft's blog post introducing what it calls the Copilot harness opens with a blunt premise. "If you want to compete, you need to be multi-model. And if you want to take advantage of everything that different AI models have to offer, you need a great harness."

The post then says the quiet part: building one that works "seamlessly across multiple models and surfaces is incredibly hard," and requires solving for performance, quality and cost.

That is a vendor statement of intent, not a measured result. Read plainly, though, it concedes the point this article is making. The model is one input. The surrounding machinery determines whether output reaches production with a reviewable record.

What Google published the same day

Google announced Gemini 4 Carbon, described in its own post as "our strongest model with state-of-the-art cybersecurity and long horizon capabilities." It builds on Gemini 4 Argon, launched roughly two weeks earlier.

The rollout detail matters more than the adjective. Google states it is "actively engaged in the U.S. government's voluntary process for pre-release model testing," and that from that week it would "make Carbon available to a subset of cyber defenders" and "gradually phase access to additional trusted partners through our Fairwind Program." Availability to developers, businesses and consumers via product surfaces is described as something Google is "continuing to gather feedback and iterate on guardrails" before doing, "as soon as possible."

That is a staged, restricted release. It is not general availability, and no date for it appears in the text.

The numbers, and how to read them

Google states that Carbon "ranks #1 on the recently updated v5.0 of Artificial Analysis Intelligence Index at 59," and reports 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation, and 71.0% on CWE-bench for patching. It also says internal benchmarks show uplift in generating secure code, and that live coding environments with its own teams show reduced misalignment and fabrication rates.

Every one of those figures is vendor-stated. None has been independently audited in the material reviewed, and none should be treated as a prediction of your environment.

The pricing line worth pausing on

Google states Carbon will launch at the same introductory price as Argon: $2 per million input tokens and $10 per million output tokens, with cached input tokens priced at 95% off the input token price.

Hold that next to an agentic workflow. Per-token pricing multiplied by an agent that loops twelve times instead of three produces a cost that scales with autonomy rather than with headcount. The invoice arrives after the deployment decision, not before it.

What Google's own examples show about multi-step use

A separate Google post on Gemini 4 Argon describes Googlers using Argon in Antigravity to "orchestrate subagents, Blender MCP, and Nano Banana" to turn photographs of a real desk into a playable 3D track. Another example has Argon parsing more than 80,000 raw NASA files into an executive-ready deck.

These are demonstrations, not deployments, and Google presents them as capability illustrations. What they illustrate is the failure mode. A workflow that coordinates subagents and external tools across dozens of steps is exactly the workflow where a passing run becomes a sample rather than a proof.

The harness argument, stated plainly

That machinery has a name in most organisations already: the pipeline. Builds, tests, policy gates, environment promotions, approvals, rollback.

The argument, from Microsoft and from the wider market, is that agents should travel through those same gates rather than around them. The implication for buyers is uncomfortable. A vendor that sells a capable model without a story about the surrounding controls is selling half a system, and the half you get is the half that demos well.

Three failure modes that break conventional controls

Test confidence collapses. Deterministic tests assume reproducibility. When agents reason across steps, teams need evaluation datasets, scoring functions and regression gates that tolerate variation while still catching real degradation.

Cost becomes per-run rather than per-seat. Budget caps, per-agent spend visibility and hard stops are governance controls, not finance niceties.

Permissions get cloned instead of scoped. The common early mistake is granting an agent the same access as the person it acts for, which makes the blast radius of a bad instruction proportional to the user base. Task-scoped identity, short-lived credentials and deny lists that cannot be escalated are the safer pattern.

Each is a system-design problem. A stronger model makes none of them go away, which is why pilots that benchmark well can still fail a security or risk review.

Seven decision criteria for buyers

Release evidence. What artefact proves what an agent did, which model and prompt version it ran, and who approved it?
Evaluation gates. Can quality be measured against a fixed dataset, failing automatically when a model or prompt changes?
Rollback. Can a deployed agent be reverted independently of the application it serves?
Inventory. Can every agent, skill and plugin across the organisation be listed, with a named owner for each?
Permission scope. Are credentials task-scoped and short-lived, with a revocation path that is not a separate project?
Cost control. Is spend attributable per agent and per workflow, with caps that stop a runaway run?
Human approval. Where are the approval points, and can they be demonstrated in your environment rather than a vendor tenant?

The seventh is the one most often answered with a slide. Ask for the demonstration.

Build, adopt or assemble: the real trade-offs

Build in-house. Maximum fit to your processes and risk appetite. The cost is permanent: you own a platform team, an evaluation framework and a security review surface that grows with every model adopted.

Adopt a platform harness. Faster to a governed pipeline, with the vendor carrying integration. The trade-off is dependency and fit, because platform harnesses encode opinions about how delivery works.

Assemble from components. Tracing, policy, secrets management and evaluation stitched together. Most common in practice, and most likely to leave a gap nobody owns, because each component is somebody's project and the seams belong to nobody.

None is wrong. The error is choosing one by default rather than by decision, then discovering at the security review which one you actually got.

A 30-day evaluation that produces evidence

Week one. Pick one workflow where output is checked downstream. Record what it currently costs to reconstruct what happened.
Week two. Define the output contract with the consuming system. Structured fields, not prose, because structure can be validated automatically.
Week three. Run real cases, including two where the correct answer is unknown at the outset. Test whether someone not in the room can reconstruct the trail.
Week four. Attempt a deliberate handoff and a deliberate rollback. Check whether permissions can be listed, narrowed and withdrawn, and whether spend can be capped per workflow.

Score reconstruction time and gate pass rates, not enthusiasm.

Where JWA fits, stated factually

JWilliams & Associates designs custom AI as a force multiplier for company staff, helping people perform meaningful work more effectively rather than making staff replacement the default goal. That is a design philosophy, not a claim about outcomes.

There is a concrete reference point inside this publication. NewsForge, the production system that prepares these articles, uses Bordy's scoped structured-output research API with durable queued requests, and NewsForge retains approval and publication authority. The AI supplies research and structure; a separate system decides what ships.

For evaluation, Bordy is offered as a 30-day free trial of Bordy Chat and, separately, a one-week free trial of the Bordy API. The offers are distinct and neither substitutes for the other. Information is published at heybordy.com for chat and bordycode.com for commercial API information, with trial enquiries through jwausa.com/contact. No outcome is promised, and none should be inferred.

Evidence notes and limits

Evidence was reviewed through the dated leads retrieved on 28 October 2026. The Microsoft quotations are taken from its blog post published that day and are a statement of intent, not a measured result. The Gemini 4 Carbon description, benchmark results, staged rollout language and pricing are Google's own statements about a restricted release and a launch price, not an established general availability or an audited performance record. The Gemini 4 Argon examples are vendor demonstrations.

No customer outcomes, adoption percentages or financial results are attributed to any vendor, because none were available to verify. The failure modes, decision criteria, comparison of options and 30-day evaluation are analysis and suggested method, not a tested protocol.

JWA and Bordy capability statements are limited to the approved product descriptions current as of 27 October 2026, and trial terms are as approved and not expanded here.