agentic-harness-patterns

Separate memory into layers: curated instruction memory, agent-written auto-memory with a type taxonomy, and background session extraction. Use a two-step save (topic file, then index) and enforce mutual exclusion between the main agent and the extractor per turn.

Route every tool call through a single permission gate returning allow, deny, or ask. Evaluate layered rules in strict priority order with deny first, and make safety checks for protected paths bypass-immune so auto-approve modes cannot override them.

Coordinator workers start with zero context for phased tasks, fork children inherit full parent context but cannot fork again, and swarm peers coordinate through a shared task list with a flat roster. Choose one pattern per session to avoid ownership ambiguity.

Skills should be lazy-loaded when the catalog is large: only metadata enters always-on context, capped near 1% of the window, and the full body loads on activation. This keeps idle token cost near zero at the price of one round-trip on first use.

Partial trust creates half-trusted states where some hooks execute and others do not, producing unpredictable behavior. Checking workspace trust once at a single dispatch point and skipping every hook when untrusted prevents remote code execution from untrusted configuration.

These patterns do not apply to prompt engineering, model selection, generic software architecture, chat UI design, or LLM API basics. They address the system around the model, not the model itself.