An Agent Harness Is Not a Security Boundary: Reading AgentSmith as a Workflow Layer

Coding agents do not fail only because a model lacks context. Teams also lose the workflow around the model: what to inspect first, what evidence counts as verification, when to hand off, and when to stop for a human.

AgentSmith is a new open-source agent harness that frames this as a composition problem. Its public repository contains a shared core/, work-type profiles/, hooks/, and a setup.sh entry point. The README describes assembling a common baseline with profiles suited to different kinds of work.

What that structure is good for

Separating stable team guidance from role-specific instructions can reduce workflow drift. Instead of copying a slightly different mega-prompt into every project, a team can keep its planning, verification, and handoff conventions visible and reusable. This is a workflow layer, not a replacement for code-navigation tools: grep, an LSP, and reading files still answer different questions about the codebase.

What it does not prove

An instruction layer does not enforce runtime isolation, credential boundaries, network restrictions, or production approvals. Those need controls that operate outside the text an agent reads: least-privilege access, audit trails, and explicit human decisions for consequential actions. The presence of an installer and a rule structure is not evidence that those controls exist.

That distinction matters most when evaluating a project called a “harness.” A useful harness can make a good process more repeatable; it cannot turn an unsafe environment into a safe one by itself.

A practical adoption test

This pattern is worth studying if your team already has review and CI conventions but keeps re-explaining them to multiple agents. Start by identifying the small set of rules that should be shared, then keep project-specific work separate. If the real need is secrets management, sandboxing, or change approval, solve those control-plane problems first.

The repository is MIT licensed, and its public releases list was empty during this review. That makes it reasonable to treat as an early design reference rather than as maturity evidence. ·

Not tested / not run: this article is based on a read-only review of public repository materials. I did not run setup.sh, install the project, or independently validate its claims or operational behavior.