2026-10-23 –, Redbud B
AI agents are increasingly being given the ability to execute commands, access infrastructure, modify code, and interact with real-world systems. But instructions, system prompts, and skills are not security boundaries they influence what an agent should do, not what it is actually allowed to do. This talk explores harness engineering as a means of enforcing those boundaries through capability control, tool authorization, validation, isolation, approvals, and auditing. We’ll also examine the limitations and new attack surface introduced by harnesses themselves, and why the harness should ultimately control what an AI agent can do.
AI security discussions often focus on prompts, system instructions, RAG poisoning, and prompt injection. These are important problems, but they overlook a fundamental question:
What happens when the model is wrong or compromised and still has the ability to act?
This 45-minute talk introduces harness engineering from a security perspective.
We'll begin by examining the limitations of instruction files, skills, system prompts, and other mechanisms that attempt to influence model behavior. These mechanisms tell the model what it should do, but they generally do not provide the same kind of enforceable boundary as traditional security controls.
We'll then introduce the AI harness as a security control plane between the model and the outside world. The talk will explore practical mechanisms including least-privilege tool access, capability brokering, argument validation, sandboxing, resource restrictions, approval workflows, policy enforcement, and audit logging.
A key concept will be the harness controller: rather than giving an agent unrestricted access to a large collection of tools, the controller can determine which capabilities are available and under what conditions. This creates opportunities for dynamic authorization and risk-based controls that are difficult to achieve through instructions alone.
We'll also look at realistic failure modes. Harnesses are not magic. They can contain vulnerabilities, implement flawed policies, expose excessive capabilities, and become attractive targets themselves. A poorly designed harness can simply move the security problem rather than solve it.
Attendees should leave with a practical framework for thinking about agent security:
- Instructions influence behavior; controls enforce boundaries.
- Models should not be trusted to enforce their own authorization.
- Tools are capabilities and should be treated like privileged interfaces.
- The harness can become the security boundary between an agent and the systems it controls.
- The harness itself must be treated as security-critical infrastructure.
The talk is aimed at security practitioners, developers, cloud engineers, and anyone responsible for deploying AI agents that can take real-world actions.
Travis spends most of his days working in the cloud/container/Kubernetes security space. He has worked in security for ~15 years. Most importantly, he is one of the select few individuals to be recognized with an official certification from Microsoft as a Microsoft Office User Specialist in Microsoft Access 2000.