Let’s talk about the layer everyone told you was the lock-in, and the layer that actually is.
For three years the warning was simple. Don’t hand your company’s brain to one model provider. Keep it portable. Don’t get stuck.
And the market listened, or at least it performed listening. Every serious platform now advertises model choice. Swap Claude for Gemini. Route by cost. Run an open-weight model in your own tenancy when the invoice gets silly. That part is real. Effective token prices paid by American businesses fell about 41 percent between March and August — roughly $1.15 per million down to 68 cents — and the share of usage going to frontier models slipped from about 53 percent to 45 percent inside a month.
So the model layer commoditised. Good news. The lock-in is dead.
It isn’t. It moved one floor up.
Here’s the formula the industry quietly settled on this year. An agent is not a model. An agent is a model plus a harness. The model reasons. The harness is everything else — the tool connections, the memory, the loop that plans and acts and observes, the guardrails, and the runtime that executes it all.
Picture the company eighteen months into this. They’ve been diligent. They built their agents on a managed runtime because it handled state, retries and scale, and the alternative was hiring four people they didn’t have. It worked. Their agents now know which suppliers get flagged, which customers pay late but always pay, which approval has to happen before a refund over a certain amount. That knowledge accumulated the way knowledge does — one exception at a time, from people who did the work.
Then they decide to switch models. And they can. That took an afternoon.
Then they try to move the agent somewhere else, and discover the agent isn’t a thing they have. It’s a configuration inside someone else’s system, written in a format only that system reads, wired to a memory store that isn’t theirs, pointing at a runtime they can’t reproduce.
Kai Waehner’s piece from 1 September names the inversion better than anything else I’ve read this year. After eighteen months, the model is a config setting and the harness is your architecture. The switching cost didn’t disappear. It inverted while procurement kept staring at benchmark tables.
Five layers wrap that model, and each one locks you in differently.
Tool and data connectivity is mostly the healthy one, because MCP has stabilised it. One caveat worth holding: an open standard with a single dominant implementer is more open than a proprietary protocol and less open than a standard with many. That’s not a technicality, that’s your future negotiating position.
Context and memory is the stickiest layer by far. And here’s the sentence to write on a wall — context compounds in value the longer it accumulates, and it compounds in exit cost at exactly the same rate.
Then the agent loop: portable in concept, proprietary in format. Then guardrails and policy, which in a regulated business is the layer your auditors will eventually want to see. Then the runtime, which is where convenience and non-portability are the same purchase.
Note what nobody is selling you. Every harness vendor claims model-agnostic, and most of them are telling the truth. Model-agnostic and harness-agnostic are different promises, and nobody makes the second one — because the harness is the product.
Now watch the adoption numbers against the control numbers, because that gap is the whole story.
The modal enterprise agent deployment roughly doubled in a single quarter — from somewhere in the 26 to 50 range up to 76 to 100. Over 80 percent plan to deploy significantly more inside a year. And the share of those agents actually being monitored has barely moved.
So we are going from dozens to hundreds of semi-autonomous workers per company while the instrumentation stays flat. That’s the layer everyone says is fine.
Then last week two hotlines launched so that AI agents can report on each other. One of them works over GET requests so a sandboxed agent can encode a complaint straight into a URL it fetches. Read that twice. We have built a whistleblower line for software because human oversight isn’t catching it, and nearly half of enterprise agents are running without anyone watching.
If your infrastructure needs a snitch line, the runtime is the problem.
There are three shapes of harness, and they’re three different deals. A framework harness lives in your code — you own everything and maintain everything, and that’s a real cost you should stop pretending is free. A managed runtime harness lives in a vendor’s cloud: they own execution, state and scale, and your agent definitions live in their format. An embedded harness lives inside an application platform — the platform owns the whole thing, and the agents work only where they were born. Salesforce shipping a “trusted enterprise AI harness” this month is that third shape arriving with a marketing budget.
None of these is wrong. The mistake is signing one without knowing which one you signed.
Operator lesson, and it’s blunt.
Stop choosing a harness on features. Run the portability test. Can you export agent definitions in a format another system can actually read — and has anyone, anywhere, ever done it? Where does accumulated context live, and can you point at it inside your own data layer? Could the runtime be re-hosted on infrastructure you control? Do you get the full audit trail, or the vendor’s summary of it? What is the realistic exit cost in engineer-months, measured today, before it grows?
Ask all five of the same vendor in the same meeting and write the answers down. The gap between the claim and the demo usually shows up somewhere between question one and question five.
And build accordingly. Keep the clever logic thin and disposable, because every model generation changes what the optimal agent structure looks like and your intricate control flow will break with the next release. Put the weight on the durable parts — state, policy, audit, and the portability of your definitions. Those survive every model release. Cleverness doesn’t. That’s not a philosophy, it’s a maintenance budget.
Here’s the part that makes this a sovereignty question and not an architecture question. That memory layer is not just rows. It’s what your people learned — what failed, who approves what, how the business actually behaves when it’s under pressure. That’s institutional memory, and it is the most valuable thing your company owns that doesn’t appear on the balance sheet.
If it lives in your data layer, the harness is replaceable infrastructure and the vendor has to earn next year. If it lives inside the harness, the vendor owns the judgment your company spent years accumulating, and you rent it back monthly with a price increase attached.
So the model is the part that changes. The harness is the part that stays. Choose the model for capability. Choose the harness for what it lets you keep.
You don’t need to own a model to be sovereign. You need to be able to walk out the door with your own context intact, in a form a human can still read, and hand it to someone else.
That’s the whole test. Everything else is a feature list.
You’ve got this.