Agents break in three different places: what they can see and touch, when they stop, and what runs next. This sheet redraws a widely shared reference from primary sources — Anthropic, OpenAI, Google, Microsoft, LangChain, UC Berkeley, OWASP — marks where it overreaches, and adds the fourth layer it leaves out: the human who signs.
The names are new; the concerns are not. LangChain's own retrospective calls graph engineering the latest name for an established way of building reliable agents.10 Treat each term as a question the system must answer, and assign every component to one of them.
What can the model see and do?
Go again, or stop?
max_turns, max_iterations, recursion_limit, spend caps, stuck detection, verify-on-stop.What runs next, and with what state?
Who may say yes?
| Stack layer | Primary discipline | What that discipline decides there |
|---|---|---|
| Interface | Harness | Where work enters and where results and questions surface. |
| Orchestration | Graph · Loop | Graph: order across steps. Loop: repetition within one step. |
| Memory | Harness | What persists outside the context window, and what is loaded just in time. |
| Models | Harness | Which model serves which node, swappable behind a stable interface. |
| Tools | Harness · Authority | Harness: scope per tool. Authority: which calls need a recorded yes. |
| State | Graph | Typed state between nodes, checkpoints, resume after failure or approval. |
| Observability · safety · evals | Loop · Authority | Loop consumes the evidence to stop; Authority audits it after the fact. |
| Deployment | Harness | Sandbox, secrets, hosting and the private network boundary. |
The source infographic28 is a useful map of the territory. Checked against the primary literature, its cut is right and several of its lines are drawn too firmly.
The three rings are a convention, not a law.
Sources disagree on the order. The reference puts harness outermost; AI Builder Club stacks graph outermost;11 Anthropic defines the harness as the loop that calls the model and routes its tool calls;5 LangChain treats a loop as a simple cyclic graph whose nodes may be full agent runs.10
Model them as concerns that recurse: a graph node can contain a loop, a loop can call a sub-graph, one harness hosts both.
The harness is drawn as a loop.
Its return arrow from final response back to gather turns the environment into a cycle and duplicates the loop panel next to it.
The harness is the environment. Whether to take another pass is the loop's decision alone.
Success exits and failure exits are mixed, and escalation is missing.
"Tests pass" is a success exit; caps are failure exits; nothing says what to leave behind on either. Berkeley's MAST taxonomy finds failure in both directions: agents unaware of stopping conditions (12.4% of annotated failures) and premature termination (6.2%).20
Four named exits — done, exhausted, stuck, escalated — each writing a handoff (section 05).
"Same call & args" only catches exact repeats.
Production detectors also catch repeated errors and ping-pong between two actions. OpenHands flags 4 identical action–observation pairs, 3 repeated action–error pairs, 3 monologue messages or 6 alternating cycles.22
Detect three patterns, not one: repeat, repeated error, alternation.
The graph has no memory of itself.
Approval and merge nodes imply pauses of minutes or days. In LangGraph that needs a checkpointer and a thread id, and code before an interrupt re-runs on resume — so earlier side effects must be idempotent.12
Checkpoint before every human pause; side effects only after approval.
"Tools: exec, fetch" has no permission boundary.
OWASP's 2026 agentic list ranks goal hijack, tool misuse and identity or privilege abuse first, second and third.23 Anthropic's managed agents keep credentials out of the sandbox entirely.5
Least agency per tool; secrets never enter the model's environment.
A verifier is not an eval suite.
A verifier judges one run; evals judge the system across runs. Anthropic separates pass@k (any of k trials succeeds) from pass^k (all k succeed): a 75% per-trial rate falls to about 42% across three.8
Ship with both, and report pass^k for anything customer-facing.
Minor marks. "Branch V" should read Branch B. "Maxiterations" is two words. "Context lost, state inconsistent, data scattered" spans two layers — memory (harness) and the state schema between steps (graph); section 08 splits it.
Same disciplines, drawn as frames rather than rings. Authority is the outer frame because it is the only layer allowed to overrule the others.
Decide returns to step 1, or leaves by exactly one of four exits:
Every major framework now offers the same primitives under different names and very different defaults. The left column is what the documentation says; the right column is the ImageFirm standard.
| Concern | What leading systems ship | ImageFirm standard |
|---|---|---|
| Step cap |
|
Never inherit a default. Declare the cap in config, next to the reason for its value. |
| Spend and time cap | Cap iterations, wall-clock and spend independently. The first cap hit decides the exit. | |
| No-progress detection |
|
Detect repeat, repeated error and alternation. Change strategy once, then escalate. |
| Success exit | Done means an independent check passed on evidence produced after the last change. | |
| Human pause |
|
Consequential actions pass a checkpointed approval with a named owner and a recorded answer. |
| Durable state |
|
State lives in a store you control, outside the model, replayable by thread id. |
| Graph engine | Deterministic spine in code, agentic loops at the nodes that need judgment. |
Units differ — turns, super-steps, iterations — which is the point: the same guard means different things in each system. Scale 0–100; hatched bars have no default limit.
A loop is finished only when it leaves through a named door and writes down where it stopped. Anthropic's long-running agents keep a progress file and leave the codebase in a clean, mergeable state at the end of every session.3
An independent check passed on evidence produced after the last change. Writes: what changed, the evidence, what was not attempted.
The first of the iteration, time or spend caps was hit. Writes: partial result flagged as partial, the cap that fired, the cheapest next step.
No-progress detector fired after one change of strategy. Writes: the repeating pattern, what was tried, the hypothesis for why.
The next step needs a decision the agent may not make. Writes: the question, the options, the agent's recommendation, the owner asked.
# ImageFirm stop policy — four exits, each writes a handoff
loop:
goal_ref: spec.md#acceptance # re-read on every pass
budgets:
max_iterations: 30
wall_clock_minutes: 20
max_cost_usd: 5.00
max_tokens: 800000
no_progress:
identical_call_repeats: 3 # same tool + args + result
repeated_error_limit: 3 # same action, same error
alternating_cycles: 6 # A → B → A → B
on_detect: change_strategy_once_then_escalate
exits:
done:
check: tests_pass_fresh_run
require_fresh_evidence: true
exhausted:
action: escalate_to_owner
stuck:
action: escalate_to_owner
escalated:
owner: "Content lead"
wait: checkpointed_interrupt
on_every_exit:
write_handoff: [what_changed, evidence, what_remains, next_step]
side_effects: after_recorded_approval_onlyDefault to the smallest structure that works. Microsoft's guidance is blunt: if a function can handle the task, write the function instead of an agent.17 Anthropic's is the same — start simple and add complexity only when it demonstrably helps.6
Known steps, no judgment. Deterministic code. Cheapest, fastest, fully testable.
One judgment, no tools needed. Classification, extraction, a rewrite. Verify the output schema, not the prose.
One job whose path cannot be predicted. One agent repeats until verified. The Ralph loop variant restarts with a fresh context each pass; Thoughtworks rates it Assess and notes the significant token cost.26
Named roles with arrows between them. Work splits into specialties, steps run in parallel then join, different models or tools per step, or the control flow must be auditable.11
Deterministic spine, agentic nodes. LangChain's three-year view is that the strongest systems mix deterministic, model and agent steps;10 Google rebuilt ADK 2.0 around that idea.14 This is the ImageFirm default for production work.
If you can name the roles and draw the arrows between them, you have a graph. If it is one job that repeats until it is right, keep it a loop. Paraphrasing the quick test in AI Builder Club, July 202611
A counter or a condition that must change. LangChain reports that production agent graphs are rarely acyclic — retries, clarification and revision all loop back.10
Wait-all, quorum, first-success or timeout — and what happens to results that arrive late.
Model-based routing is slower, costlier and less predictable than code; Google cites exactly this as the reason for ADK 2.0's graph engine.14
Typed state between nodes, with strict boundaries per node to limit context bloat.14 Unify execution state with business state.24
Durable checkpointer, stable thread id, idempotent nodes; side effects after the approval, never before.12
Small, focused agents with their own tool allowlists keep failures local and prompts short.24
Birgitta Böckeler sorts harness elements into guides and sensors, each either computational (deterministic) or inferential (model-based).2 The matrix below places the practices with the strongest public evidence into that frame.
Each part of a harness encodes something the model could not do alone. Anthropic added context resets for one model and found them to be dead weight on the next.5 Re-run the eval suite with each component removed at every model release.
A source-code study of eleven coding agents shows all seven harness subsystems can fit in about 100 lines, and found that loop sophistication did not predict benchmark results.21 Add parts only against a measured failure.
Fourteen modes come from UC Berkeley's MAST taxonomy — 1,642 annotated traces across seven multi-agent frameworks, inter-annotator κ of 0.88.20 Seven more cover security and operations. The layer assignment is ImageFirm's.
No symptom matches. Clear the search or choose another layer.
ImageFirm adds a fourth discipline because the other three can each be correct and the system still be wrong. Its job is the one Böckeler names for any good harness: direct human input to where it matters most.2
| Principle | Harness | Loop | Graph |
|---|---|---|---|
| Transparency | Session log and traces readable by people, not only by agents. | Every exit writes its evidence. | State at every edge can be inspected and replayed. |
| Agency | Least-agency tool scopes. | Escalation is a first-class exit, not an error. | Approval nodes before consequential actions. |
| Growth | Specs and docs live where people read them too. | Handoffs teach the next person or agent. | The workflow is drawn, so it can be learned. |
| Responsibility | A named owner per tool scope. | A named owner per stop policy. | A named owner per node and per gate. |
| Sovereignty | Credentials outside the model's environment; models swappable behind stable interfaces.5 | Budgets enforced in your runtime, not the vendor's. | Checkpoints stored in systems you control. |
Article 14 of the EU AI Act requires human oversight of high-risk AI systems. The Digital Omnibus on AI — Regulation (EU) 2026/1744, in force since 27 July 2026 — moved Annex III high-risk obligations to 2 December 2027 and Annex I to 2 August 2028.27 An authority layer built now is cheaper than one retrofitted later. This is analysis, not legal advice; confirm scope and classification with licensed counsel.
Ticks are kept only in this browser, on this device.
Primary sources first. Where only a secondary source carried a figure, it is named as such. Numbers are as published; percentages from MAST are shares of annotated failures.
ClaudeAgentOptions — Anthropic, repository and generated reference