Who Governs the AI Harness? The Faustian Pact Between Convenience and Independence

Several technology vendors now offer to govern agents operating across competing platforms. Their growing influence can sometimes conflict with the need for independent enterprise control.

The head of AI at a major global bank told me recently that the bank now considers placing execution, policy and evidence with a single vendor a major risk. A year ago, many enterprises were exploring what AI could do for the business, deciding which models to use and which activities, processes and workflows to pilot. Today, as more agents move into production, attention is turning to the software that runs them, enforces their operating rules and records their actions. The bank’s concern reflects a broader tension between the growing control of a handful of technology vendors over agentic AI and the enterprise’s need for sovereignty and independence.

At the centre of this tension is the AI harness, the software that enables agents to use AI models, access enterprise systems, call tools and execute tasks. Depending on its architecture, the harness also manages memory, permissions, approvals and operational records. As agents take on more enterprise activities, the harness becomes critical to their operation and governance.

Major technology vendors are competing to supply this infrastructure, while several are extending their governance capabilities to agents developed on competing platforms. For enterprises, the attraction of a vendor-centred approach is clear. They can use familiar management tools, existing identity and security infrastructure, and a common control plane to govern agents across multiple environments, reducing complexity and the burden of managing separate systems.

This convenience presents enterprises with a potential Faustian pact. The more they rely on a single vendor to manage agents, enforce policies and maintain operational evidence, the greater the risk of sacrificing enterprise sovereignty. Over time, that dependence becomes increasingly difficult to unwind, limiting their ability to exercise independent control or move to another provider. I have assessed the leading vendors to establish the extent of that risk and the independence enterprises can retain.

The harness becomes the control point

The competitive environment for enterprise AI is changing radically. As foundation models become more interchangeable, the software surrounding them is becoming an increasingly important source of commercial value and operational control.

An enterprise might use Claude for software development, OpenAI models for analytical tasks and Google models for other workloads. Switching between models may be relatively straightforward, but replacing the harness becomes more difficult as it accumulates agent configurations, tool connections, execution policies, operational records and integrations with enterprise applications.

Vendor dependence may therefore shift from the model to the harness, particularly when the same platform executes agents, enforces their policies and maintains the evidence used to assess their conduct. Over time, the harness becomes increasingly sticky, with enterprises sinking deeper into vendor dependence as switching becomes progressively more difficult. Like quicksand, the longer they remain, the harder it becomes to escape.

Operational enforcement needs to remain close to agents so that policies can be applied quickly and consistently. Enterprises must nevertheless retain authority over those policies, access to independently verifiable evidence and the ability to intervene when an agent behaves unexpectedly, particularly when agents operate across multiple enterprise systems. They must also remain razor-focused on the growing risk of vendor dependence and louder demands for enterprise sovereignty.

The balance between enterprise sovereignty and convenience

Several technology vendors are developing control planes that extend beyond their own agent environments.

Salesforce markets MuleSoft Agent Fabric as a control plane for agents, APIs and MCP servers operating across Agentforce and third-party platforms. ServiceNow’s AI Control Tower provides visibility into AI assets and integrates with external environments, including Microsoft’s agent ecosystem. Microsoft’s Agent 365 extends identity and governance capabilities to registered third-party agents, while Workday applies established permissions and approvals to supported agents operating through its Trusted Agent Platform.

These capabilities address enterprise requirements. Large organisations cannot reasonably manage growing populations of agents through disconnected consoles, particularly when those agents interact with common data, applications and business processes. The convenience of using familiar management tools, established security infrastructure and a common control plane is enormous. Consolidated governance can also improve visibility, accountability and operational consistency.

The tension between convenience and enterprise sovereignty becomes more pronounced as control planes extend across competing environments. Enterprises gain the ability to oversee more agents through a common platform, but may surrender control over the policies and evidence used to assess their conduct. The greater the reach of the control plane, the more dependent they may become on the vendor operating it.

As I argued in my earlier Salesforce analysis, cross-platform reach does not establish independence from the vendor providing it.

Assessing vendor approaches to harness governance

I have assessed a selection of major technology vendors according to how far their harness architectures and associated governance capabilities allow enterprises to operate independently of the vendor’s managed environment.

The assessment considers whether important governance controls can be deployed and enforced independently, the extent to which those controls cross different agent environments, and whether enterprises can retain and verify operational evidence outside the vendor’s infrastructure.

These criteria draw on the broader principles of independent agentic AI governance published by Veqtor8 earlier in 2026. The vendors are placed into three broad categories according to the independence supported by their documented architectures, with OpenAI considered separately because insufficient information is available for analysis. Evidence export alone does not determine placement. The assessment also considers dependence on the vendor for policy enforcement, identity and the operation of the control plane. These are qualitative assessments of specific technologies rather than comprehensive rankings of each vendor’s AI capabilities.

Independent deployment possible

Core governance capabilities can operate outside the vendor’s managed platform, although the extent of independence depends on the deployment architecture.

Nvidia

Nvidia’s OpenShell is an open-source runtime that enforces restrictions outside the agent, controlling access to files, networks, tools and credentials. By applying controls in the runtime environment rather than relying exclusively on instructions within the model, OpenShell provides a means of enforcing policies independently of the agent’s own decision-making.

Enterprises can deploy OpenShell on infrastructure they manage, allowing key enforcement functions to operate outside Nvidia’s commercial platform. OpenShell can enforce these controls beneath application-level agent frameworks, enabling policy enforcement to operate independently of the frameworks themselves. This assessment concerns OpenShell specifically rather than Nvidia’s wider commercial AI infrastructure.

Databricks

Databricks has taken a different approach to agent governance, developing an open-source meta-harness that can coordinate agents operating across different environments.

Omnigent, released as an open-source alpha in June 2026, supports Claude Code, Codex, Pi and custom agents. Rather than requiring enterprises to adopt a single agent framework, it provides a common layer for configuring agents, connecting them to tools and coordinating their work.

The technology emerged from Databricks’ own experience. Its engineers were running multiple coding agents simultaneously and wasting time transferring information between them. Omnigent was developed to allow these agents to work together more effectively, even when they use different underlying harnesses.

Databricks also offers established governance technologies, including Unity Catalog for controlling access to data, Unity Gateway for managing model and tool interactions, and MLflow for recording and evaluating agent activity. Enterprises can run Omnigent on their own infrastructure and choose whether to integrate it with Databricks’ wider governance services.

Running Omnigent independently gives enterprises greater control over how agents are coordinated and where operational records are maintained. Integrating it with Databricks-managed services can reduce the burden of operating supporting infrastructure but introduces greater vendor dependence. The open-source software does not necessarily provide every capability available through Databricks’ wider managed platform.

Databricks has gone further than most major data and application platform vendors in supporting independent deployment. However, enterprises need to examine which governance functions they can operate independently and which rely on Databricks’ managed services.

Partial independence and portable evidence

These offerings support forms of policy portability or customer-controlled operational evidence, while some governance functions remain dependent on vendor-managed services.

AWS

Amazon Bedrock AgentCore supports multiple agent frameworks and models, allowing enterprises to develop agents without committing to a single model provider.

Its gateway provides a common point through which agents can access enterprise tools and services. AgentCore Policy can evaluate these interactions against rules written in Cedar, an open-source policy language. Enterprises can therefore establish policies independently of individual agent implementations and enforce them through the gateway.

The gateway, policy enforcement and associated operational services run within AWS, with decision records available through AWS logging and monitoring infrastructure, including CloudWatch. Enterprises can export these records, although they remain dependent on AWS to enforce the policies and generate much of the evidence used to assess agent activity.

Google Cloud

Google’s Gemini Enterprise Agent Platform combines agent identity, registration, gateways and operational governance capabilities, supporting different models and agent environments, including third-party technologies.

The platform provides centralised controls over agent interactions with enterprise systems, while OpenTelemetry support enables operational data to be collected using a widely adopted standard.

Google’s governance services remain closely integrated with Google Cloud infrastructure. OpenTelemetry support provides a standard format for operational records, but the documented observability architecture remains closely integrated with Google Cloud. Enterprises remain dependent on Google for the enforcement of policies and the generation of much of the evidence used to assess agent activity.

Anthropic

Anthropic’s Claude Code allows enterprises to retain a degree of independent control over agent execution and operational evidence. Agents operate in the enterprise’s own environment, where locally executed controls known as hooks can check or block certain actions before they occur.

Claude Code also supports OpenTelemetry, allowing enterprises to send records of agent activity to monitoring systems they control. This reduces dependence on Anthropic for maintaining operational evidence, although the available telemetry does not necessarily capture every action or decision.

These capabilities give enterprises more direct control over execution and evidence than platforms where enforcement and monitoring depend primarily on vendor-operated infrastructure. However, Claude Code’s controls apply to its own execution environment. Anthropic does not provide an equivalent enterprise-wide control plane for governing agents operating across competing platforms.

Vendor-centred control

These offerings provide substantial governance capabilities through vendor-managed platforms, including controls extending to third-party agents. However, enterprises have limited independence from the vendors operating these platforms, particularly in relation to policy enforcement and the generation and retention of operational evidence.

Microsoft

Microsoft has extensive enterprise governance capabilities across Agent 365, Entra Agent ID, Defender and Purview. These technologies support agent identity, ownership, permissions, security monitoring and information governance, while Agent 365 extends aspects of Microsoft’s governance model to registered third-party agents.

Integration with enterprise identity, productivity applications and security infrastructure gives Microsoft advantages in organisations heavily dependent on its technology.

As more third-party agents are brought under Microsoft’s governance services, enterprises may become increasingly dependent on Microsoft to maintain identity, enforce policies and consolidate operational evidence. Although Microsoft provides mechanisms for accessing and exporting security and operational data, its deep integration across enterprise systems makes the governance architecture increasingly sticky. Replacing Microsoft’s control plane could become costly and disruptive, reinforcing vendor lock-in and limiting enterprises’ ability to exercise independent governance.

Salesforce

Salesforce is extending its governance capabilities beyond Agentforce through MuleSoft Agent Fabric, Salesforce Guardian and its broader AI control-plane strategy.

The approach combines agent orchestration, enterprise data access, workflow integration and governance across Salesforce and third-party environments. Organisations using Salesforce extensively may benefit from managing more agent activity through established application and data governance mechanisms.

However, bringing third-party agents under a Salesforce-managed control plane risks further entrenching Salesforce within enterprise operations. As more agents, workflows and governance policies become dependent on its infrastructure, switching costs increase and replacing the control plane becomes progressively more difficult. Enterprises could find themselves deeply embedded in the Salesforce ecosystem, with limited independence over the enforcement of policies and the operational evidence used to assess agent activity.

ServiceNow

ServiceNow’s AI Control Tower provides visibility and governance across AI assets, including integrations with third-party agent environments.

Its established position in enterprise workflows and service management allows agent activity to be associated with business processes, operational ownership and accountability.

AI Control Tower remains a ServiceNow-managed capability, and organisations extending its reach across their agent environments may become increasingly dependent on ServiceNow to maintain the resulting governance records. I have previously described this form of dependence as a golden cage, where extensive integration and operational convenience make it progressively harder for enterprises to move governance elsewhere.

Workday

Workday approaches agent governance through its established control over enterprise roles, permissions, business processes and transactions.

Its Trusted Agent Platform extends these mechanisms to supported third-party agents operating within Workday, allowing autonomous activity to be governed by existing permissions and approval processes. Workday’s planned acquisition of C1.ai also indicates an intention to strengthen its agent identity capabilities.

These controls are primarily exercised within Workday’s environment. An enterprise can govern what an agent is permitted to do within Workday while remaining dependent on other platforms for oversight of that agent’s activity elsewhere. Public documentation provides limited detail on the extent to which complete execution records can be independently retained and verified outside Workday.

Too early to assess

OpenAI

OpenAI’s Frontier platform brings agent identity, permissions, monitoring and auditing into a managed enterprise environment.

These capabilities are relevant to harness governance, although the public evidence available for Frontier remains insufficient to establish how far enterprises can operate governance independently of OpenAI.

OpenAI documents tracing and export mechanisms for other products, including its Agents API and ChatGPT Enterprise. Those capabilities cannot automatically be assumed to apply in the same way to Frontier.

The commercial incentives behind harness governance

The vendors analysed approach harness governance from different commercial and architectural positions.

Nvidia’s OpenShell and Databricks’ Omnigent offer independently deployable technologies that can support governance across agent environments. AWS, Google and Anthropic provide varying degrees of interoperability, policy portability and customer-controlled telemetry, although their offerings differ considerably in scope.

Microsoft, Salesforce, ServiceNow and Workday bring established enterprise identity, application and workflow capabilities to agent governance. Their strength lies in connecting agents to the business systems, permissions and processes that organisations use.

Commercial incentives influence these approaches. Enterprise application vendors benefit when more business activity operates through their platforms, while infrastructure and developer-tool providers may benefit from supporting a broader range of agent environments. Infrastructure vendors also have strong incentives to encourage adoption of their managed services, and open-source components can coexist with considerable commercial dependence.

An organisation may obtain excellent operational controls from a managed platform while becoming increasingly dependent on the vendor to enforce those controls and produce the evidence needed to verify their effectiveness.

Enterprise sovereignty requirements for AI harnesses

Enterprises must establish and maintain sovereignty over agent operations as agents become embedded in their businesses, particularly when execution, policy enforcement and operational evidence are managed by technology vendors. Four requirements deserve particular attention.

Independent evidence. Enterprises should retain agent activity records in systems they control, with sufficient detail to reconstruct actions across platforms. They must also establish the completeness and integrity of the evidence, particularly when agents invoke other agents or interact with external applications.

Portable policies. Governance requirements should be documented and, where practical, expressed in formats that can survive a change of harness or platform. Enterprises need to understand which policies can be transferred between environments and which depend on proprietary enforcement mechanisms.

Persistent identity and accountability. Every agent should have an identifiable owner, defined authority and an auditable record of its actions, including when agents interact with other agents, use delegated permissions or move between enterprise systems.

Independent intervention. Enterprises should be able to suspend agent activity, revoke permissions and investigate incidents without depending exclusively on the cooperation of the platform being examined.

These requirements are easier to address during procurement and architecture design than after hundreds or thousands of agents have become embedded in enterprise operations.

Who governs the harness?

As AI models become more interchangeable, harnesses are becoming important sources of commercial value and operational authority. The vendors supplying them are also competing to govern agents operating across other platforms, increasing their influence over enterprise operations.

Nvidia and Databricks stand out for providing governance-related technologies that enterprises can deploy independently of their suppliers’ managed environments. Other vendors offer extensive operational governance capabilities, but their control planes frequently concentrate policy enforcement and operational evidence within their own commercial platforms.

Enterprises will continue to rely on these technologies because integrated governance provides genuine operational benefits. They must nevertheless retain the authority to establish governance policies, independently verify agent activity and intervene when necessary, regardless of which platform operates the agents.

The harness may control the agents, but it must never become the final authority over its own conduct. No platform can govern itself.

Andrew Milroy is the founder of Veqtor8, an independent technology advisory firm focused on AI, cybersecurity, cloud and data management.

This article reflects the author’s independent assessment of publicly available vendor documentation, informed by conversations with enterprise technology buyers and decision-makers.