This shouldn't be a hot take: the model is the least interesting part of a production agent.
Models get swapped all the time. The harness, meaning the code that decides what the model is allowed to touch, is what decides whether an agent is safe to run against real systems.
What goes into every harness we build:
Tool permissions per agent, not per platform. A research agent doesn't get a send-email tool just because one exists.
Scoped credentials. Short-lived tokens with least privilege, issued per task where possible. The agent never holds a secret it doesn't need; the harness injects auth at call time.
Approval gates for consequential actions. Sends, payments, deletes, and anything external or irreversible pause for a human, who sees the exact payload instead of a summary.
Audit logs. Every tool call, its arguments, its result, and who approved what. If you can't replay what happened, you can't debug it or defend it.
Sandboxes. Code execution and browsing run in isolated environments with no path to production by default.
Reversible by default. Drafts over sends. Soft deletes over hard deletes. Branches over main. When the agent gets something wrong, the cost should be a rollback, not an apology.
A better model makes a well-built harness more productive. It doesn't make a bad harness safe.
That's how Cipher, our own agent, runs every day: broad capability, narrow permissions, and a human on anything irreversible.