You ask an AI assistant, in a chat, for last quarter's margin per customer. It replies with a neatly formatted table, which you copy by hand into your workbook. The same model, built into your spreadsheet, reads the workbook, writes a formula in column F, creates a chart and asks you to check the result. The model has not changed. What surrounds it has.
One model, two products: in a chat, a table copied by hand; in the spreadsheet, a formula, a chart and a request to check the result.
What surrounds the model
An LLM does one thing: it produces text from what it is sent. Reading a file, changing a cell, sending an email or checking a calculation is not the model's job; the application around it does that. Technical teams call this layer the harness. The image comes from draft horses: the animal supplies the power; the harness steers it.
Key concept
The harness is everything around the model in a product: the instructions, the files it can read, the tools it can use, its permissions, its memory, the checks and the loop that keeps it working. The model proposes; the harness decides what it sees, what it can do and what gets checked before the result counts.
The seven parts of a harness
At the centre, the model does one thing: it produces text from what it is sent. The application around it does the rest.
Instructions. The tool's vendor writes its own, which you do not see. You often add yours. As of October 2026, Claude for Excel, Anthropic's add-in for Excel, offers an instructions field that applies to every conversation. As of the same date, Intercom's support assistant, Fin, follows guidance written by administrators: brand voice, company policies. Prompting: briefing a model well explains at which level each instruction belongs.
What it can read. The open workbook, a shared folder, your customer service knowledge base. Anything left out of its context window, the text in front of it at a given moment, does not exist for it. On a loosely specified task that spans several apps, the useful information often sits where the request does not point: a rule in an old email thread, a forgotten tab, a note on a customer record. As of October 2026, Anthropic reports that telling the tool to look through the relevant sources before acting clearly improves its results on this kind of task. But the tool then acts on what it finds: keep any content of unknown origin out of what it searches.
Tools. Writing a formula, creating a slide, looking up an order, running tests. Each tool is an action the application carries out at the model's request. The model phrases its request in a format fixed in advance: it is the same idea as structured outputs.
Permissions. What the tool does on its own, and what waits for your approval. As of October 2026, Gemini in Google Sheets shows a preview card of the proposed action before it changes the sheet.
Memory. Notes kept from one conversation to the next, then put back into the context window. The model itself retains nothing.
Checks. A recalculation, tests, a rule that blocks an amount, a handoff to a human. These are the guardrails built into the harness.
The loop. The tool acts, looks at the result, fixes it and tries again, until the task is done or a limit stops it. The loop is what turns an answer into finished work. It is also what can repeat a mistake a hundred times.
The same model, two products
As of October 2026, Microsoft states that Copilot in Excel works with the latest Anthropic and OpenAI models. A Claude model can therefore work in Copilot in Excel as well as in Claude for Excel. The two products do not have the same hidden instructions, the same tools or the same confirmation prompts. On the same workbook, their results can therefore differ.
This has two consequences. A model leaderboard does not tell you which product will do your work best. And when the vendor changes its harness, the tool's behavior changes too, even if the model stays the same. Test the tool on your tasks, with your files, and run those tests again after a major update.
What you control, what the vendor controls
You control part of the harness: your instructions, the files and connectors (connections to your other software) you open up, the permissions you grant, the review steps you require. The vendor controls the rest: its own instructions, the list of tools, how memory is handled, the limits of the loop and, often, the model.
Your instructions guide the tool without binding it. As of October 2026, the documentation for Claude Code, Anthropic's coding agent, says as much about its instruction files: the model reads them as context, not as enforced configuration. A rule that must always apply goes into a permission or a check, not into a sentence in the instructions.
Where errors hide
A harness that acts produces errors that are harder to see than a wrong sentence in a chat.
In a spreadsheet, a formula that covers the wrong range produces a plausible number. That wrong number recalculates silently and spreads to other tabs. Read the formula, not just the result.
In a presentation, a number from the wrong quarter borrows the credibility of a polished chart. Trace every number on the slide back to its source.
In an email or a support reply, the error reaches the customer. Once it is sent, it is too late to fix.
The vendors say so themselves. As of October 2026, Anthropic tells users to always review Claude for Excel's changes, and Google warns that Gemini may suggest inaccurate information.
What the tool can change or send
It sends or acts outside your files: an email, a customer reply, writing data into another app. Its actions cannot be undone: this category calls for the most caution.
Sort each tool into one of three categories. It suggests, and you decide. It changes your files, and you can undo the changes. It sends or acts outside your files: an email, a customer reply, writing data into another app. The third category calls for the most caution, because its actions cannot be undone.
As of October 2026, Intercom's Fin can read live data from connected apps such as Shopify or Stripe, and hand the conversation over to a team member. As of the same date, Zendesk's AI agents can update data outside Zendesk through an API you designate, that is, an access point one piece of software opens to another. In both cases, administrators grant these rights. Grant them one at a time, starting with read-only access.
Choosing a tool by its harness
The model's name is not enough to compare two tools. Ask these questions instead. What does it read, and who chooses what it reads? What can it change or send without asking? Can you undo what it does? Does it keep a memory, and can you see it? What does it check before handing back control? A tool whose documentation answers these questions clearly is often worth more than one that advertises the newest model.
What it means for you
For founders
Before paying for an AI tool for your team, ask the vendor about the harness, not only the model: what it reads, what it can send, what requires confirmation. Those answers tell you more than the model's name about whether the tool is safe for your customers and your data.
For product managers
When you design an AI feature, you design a harness. Write it into the spec: the instructions, the sources the model reads, the tools it calls, what requires confirmation and what gets handed to a human. The quality users perceive often depends on it more than on the choice of model.
For tech leads
Treat the harness as code. Version the system prompt, the instruction files and the permission configuration. Put mandatory rules into deterministic checks, not into the instructions. Rerun your evals (short for "evaluations") when you change models, but also when you or the vendor change the harness.
For business leaders
Rolling out AI in spreadsheets and presentations means setting team rules on the harness: which files the tool may open, what it may send outside the company, and who checks the figures before they leave. These rules matter more than the choice between two models.
The classic mistake
fAIling RULE III
The trap: Automate before you understand
Giving a tool the right to change and send before knowing what it reads and what it checks is automating blind. A wrong formula applied to ten thousand rows, or a wrong reply sent to a hundred customers, goes out as fast as a correct one. Start with read-only access, watch what the tool does on your real cases, then grant rights one at a time.
Read rule III in the manifestoTry it
Take an AI tool you already use in a spreadsheet, a presentation or your inbox. Answer seven questions in writing: what instructions does it follow, what can it read, what tools does it have, what does it do without asking, does it keep a memory, what does it check, and when does it stop? Look for each answer in the tool's settings or documentation. The questions left unanswered are your risks: deal with them before you widen its rights.
Around this topic
Go deeperCoding agents, one harness among others
Coding agents make the harness very visible. As of October 2026, Claude Code reads an instruction file, CLAUDE.md. In its default mode, it asks for your approval before most file edits and commands. OpenAI's Codex reads an AGENTS.md file before doing any work and follows an approval policy you set. GitHub's Copilot cloud agent works in a temporary environment, runs the tests and opens a pull request, that is, a proposed change to the code, which GitHub asks you to review. These are the same parts as in a spreadsheet assistant: instructions, tools, permissions, checks and the loop.
Go deeperMemory, a part you can see
An assistant's memory is part of the harness, not of the model: the application keeps notes and puts them back into the context window. As of October 2026, Claude and ChatGPT both let you view, edit or delete what has been remembered, and turn memory off. At Anthropic, memory is on by default on the Free, Pro and Max plans. Check this setting before you handle sensitive data.
Go deeperWhere the word comes from
The term comes from teams that build agents. In January 2026, an Anthropic engineering article defined an agent harness as the system that enables a model to act as an agent. The same model in two harnesses therefore makes up two different systems, each to be evaluated on its own.
What to do with it
Compare tools by their harness, not the model name: what it reads, what it can do and what gets checked can change the result.
Put a rule that must always apply into a permission or a check, not into a sentence in the instructions.
Start with read-only access, watch the tool on your real cases, then grant the rights to change or send one at a time.