← Back
Agent Harness
A single agent layer — a consolidated context brain and workflow engine taking the place of what would eventually become dozens of agents. It has access to data from every source it needs and selects the deterministic or agentic jobs to run. An administrator, analyst, and thinking partner in one.
The Agent Loop
trigger: cron | inbound email | chat | api call (pitch tool)
|
v
+- HARNESS (Claude Agent SDK) --------------------------+
| |
| agent loop --- skills (markdown: how we do things) |
| | +-- memory (firm + per-deal, versioned) |
| v |
| PRE-TOOL GUARDS (coded, deterministic) |
| v |
| tools: hubspot | msgraph | database | subagents |
| v |
| POST-TOOL AUDIT (every call, allowed or denied) |
| |
+-------------------------------------------------------+
|
v
runner: budget caps + immutable run record + escalation
Why One Agent, Not Dozens
The value is in the shared context. A dozen specialized agents means a dozen partial memories, a dozen audit surfaces, and a dozen places for the same fact to drift. One loop with one memory means the buyer research job benefits from what the email-intake job learned last week — the consolidation is the product.
Adding a workflow is writing a YAML file and a skill, not standing up a service. The expensive parts — tools, guards, memory, audit — are built once; each new job is cheap.
The Four Layers
+---------------+ +-----------------+ +---------------+ +--------------+
| BEHAVIOR | | OPERATIONAL | | WORK PRODUCT | | RECORD |
| | | STATE | | | | |
| jobs YAML | | deal registry | | email drafts | | runs |
| skills | | memory files | | cleaned fins | | tool calls |
| subagents | | schedule toggle | | buyer lists | | guard denies |
| charter | | run-now | | filed docs | | memory hist |
| | | | | | | costs |
+---------------+ +-----------------+ +---------------+ +--------------+
| | | ^
| git deploy | instant | human sends | writes
| (reviewed) | (audited) | (last mile) | forever
v v v |
+-------------------+-------------------------------------+---+
|
v
+---------------------------+
| SCHEDULED JOB LOOP |
| scheduler @ 60s |
| compose - work - write |
+---------------------------+
Scheduled Job Lifecycle
+--------------+ +--------------+ +--------------+ +--------------+
| | | | | | | |
| COMPOSE |----+| WORK |----+| WRITE |----+| RECORD |
| | | | | | | |
+--------------+ +--------------+ +--------------+ +--------------+
| | | |
v v v v
+--------------+ +--------------+ +--------------+ +--------------+
| variables + | | agent runs | | CRM notes | | run row + |
| deal context | | tools inside | | filed docs | | tool calls + |
| substitute | | coded guards | | memory | | guard denies |
| into prompt | | denials get | | updates | | + cost |
| | | reasons back | | drafts saved | | + prompt |
+--------------+ +--------------+ +--------------+ +--------------+
Design Decisions
01
Skills are markdown, on purpose
The layer that encodes how we do things — buyer-list conventions, filing rules, who gets escalations — is plain files anyone at the firm can read and, eventually, edit. Engineers own the tools and guards; the professionals own the process knowledge.
02
Workflows will be tailored per person
The end state is every internal employee editing the skills their work depends on — the same harness composing my jobs differently than a colleague's, because our skills and context differ.
03
Behavior lives in git; state edits are instant
Changing what the system does is a reviewed code change, deployed deliberately. Facts and switches — deal registry, memory, schedule toggles — change instantly from the UI, chat, or the agent itself, audited, converging on one store.
04
Guards are code, not prompt
Anything that can be a rule is enforced deterministically at the tool boundary. A prompt can be talked out of a rule; a guard cannot. Denials return reasons the agent adapts to, escalates, or stops on.
05
The database is physically siloed
The harness shares Postgres with the client VDR but connects as a role that owns its own schema and holds SELECT-only rights on everything else. It reads deals and transcripts for context; it cannot write client data. Not a policy — a missing grant.
06
Work product is drafts, not sends
No external send capability exists. Emails land in Outlook drafts, docs land in SharePoint, buyer lists surface in the pitch tool. A human finishes.
07
Every run is a record; failures escalate
Composed prompt, tool calls, guard denials, memory versions, cost — read-only forever. Crashes, over-budget runs, and unsuccessful results email a transcript tail; the agent is also prompted to escalate when blocked.
Stack
Python
FastAPI
PostgreSQL
Claude API
Anthropic MCP
Microsoft Graph
HubSpot API
Render Cron
Multiple jobs, mostly daily. Scheduler ticks every 60s. All access authenticated via bearer token.