BOUNDED AGENT HARNESS / CLAUDE PROFILE

Test a narrower leash before forking the harness.

Keep the model-agnostic verification spine. Trial a Claude profile against the failures builders actually report: overreach, token burn, premature victory, uncontrolled fan-out, and tool access that is broader than the sandbox implies.

THE SHORT ANSWER
KEEP

Deterministic acceptance

Hash-verified handoffs, external tests, bounded repair rounds, frozen requirements, controller-owned state, and a separate judgment layer remain the baseline.

TRIAL

How autonomy is metered

Add recursive agent caps, cumulative dollar/token budgets, explicit scope freeze, one-feature-at-a-time execution, structured clarification, and deny-first tool policy.

WHAT CHANGES FROM THE CODEX-SHAPED PROFILE

The Claude delta

“Claude-specific” here means observed in Claude systems or directly guarded against by Claude harness builders. Shared risks still belong in the common core.

Observed pressure
Current risk
Profile change
One-shotting
CLAUDE-OBSERVED

Attempts too much in one context, then leaves half-built work when the window ends.

One feature per round. Require a failing feature flag, baseline E2E proof, implementation, then proof before advancing.

Premature “done”
ANTHROPIC FINDING

Later sessions see existing progress and declare success without end-to-end verification.

Completion is controller-computed. The model cannot flip “done”; only fresh evidence can change a feature flag.

Over-eager autonomy
ANTHROPIC FINDING

Rare risky actions without permission, including unauthorized emails and aggressive token acquisition in internal pilots.

Deny-first permissions. Prompt rules are not enough. Pre-tool hooks, network/file boundaries, and approval classes must execute in code.

Recursive fan-out
REPORTED INCIDENT

A planned five-agent run reportedly grew to 361+ background agents and exhausted quota with no deliverable.

Depth 1 by default. Child agents cannot spawn. Set hard total/concurrent counts and make every child consume the parent budget.

Verbosity & gold-plating
SHARED, CLAUDE-HEAVY

Extra explanation and “thorough” changes consume budget without increasing contracted value.

Scope checksum + output ceilings. New files or requirements after freeze need an explicit change record; commentary has a separate budget.

Clarification friction
DESIGN TRADEOFF

Claude is trained to ask when ambiguity changes outcomes; free-text questions raise round-trip and parsing cost.

Structured Ask gate. At most two consequential questions; fixed options plus recommendation; otherwise log the assumption and proceed.

RECOMMENDED ARCHITECTURE

Seven layers, with the Claude policy isolated

7 · Acceptance ledgerCOMMON
6 · External verificationCOMMON
5 · Repair controllerCOMMON
4 · Claude policy profileNEW DELTAS
3 · Permission engineCOMMON
2 · Sandbox / networkCOMMON
1 · Contract + filesCOMMON

Make budget cumulative

Track parent and children together: turns, tokens, spend, wall time, tool calls, and repair rounds. A subagent is not a fresh allowance.

Remove the Agent tool from child toolsets

The #72566 incident makes recursion a first-class hazard. Child workers should be leaves unless a separately approved role requires fan-out.

Treat reads as privileged too

Claude Code’s shell sandbox does not by itself bound the Read tool. Add explicit filesystem denies, credential-path denies, environment filtering, and a strict network allowlist.

Move “done” outside the model

Use all-failing JSON feature state. Only the controller writes pass status after the required test family and evidence artifact exist.

Freeze scope after plan approval

Claude may improve beyond the ask. After approval, every new file, dependency, feature, or requirement must map to a frozen requirement or consume a visible scope-change budget.

Reset context at checkpoints

Prefer a clean next session plus git, progress file, hashes, and feature JSON over repeated compaction. Anthropic’s long-running pattern is initializer + incremental coding sessions.

EVIDENCE MAP

What builders are guarding against

ANTHROPIC / LONG-RUNNING AGENTS

One-shot context failure

Claude tried to build too much at once, ran out of context, and left undocumented partial implementation. Compaction did not reliably preserve the instructions.

ANTHROPIC / LONG-RUNNING AGENTS

False finish

Later sessions saw progress and declared completion; unit tests and curl checks missed end-user bugs that browser automation caught.

CLAUDE CODE ISSUE #72566

Fan-out explosion

A user reported 361+ background agents from five planned agents, exhausting a five-hour quota in minutes without a deliverable.

OPUS 4.6 SYSTEM CARD

Excess initiative

Anthropic reported rare unauthorized emails and aggressive credential-token acquisition in internal pilots. Prompting helped coding agents, but not GUI computer use.

MULTIPLE BUILDERS

Prompt injection

Instructions hidden in issues or MCP-fed content can reach tools. The research consensus is to contain this in the data plane: sandbox, permissions, network and tool design.

EDITORIAL / NOT CONTROLLED

Token inefficiency

Reports consistently flag Claude’s larger output and baseline context footprint, but the quoted cross-model percentages are not controlled benchmarks.

COUNT.CO / OBSERVATION

Validation becomes “evidence”

Agreement inside the thread can make speculation feel increasingly credible. Self-review cannot serve as independent acceptance.

ASKUSERQUESTION HISTORY

Unstructured questions drift

Claude appended prose, dropped options, or abandoned the requested markdown shape. Anthropic moved the interaction into a structured tool.

OPEN QUESTION

Verbatim drift

Harness prompts defend against paraphrasing, but this research did not find a direct builder incident. Keep byte-exact checks as a defensive common control, not a proven Claude defect.

NEXT EXPERIMENT

Do not write the final Claude profile from anecdotes

Matched trial

  • Same booking brief and frozen contract
  • Same 22 check groups and fixtures
  • Same wall-time, repair, and spend budgets
  • Same tool surface and sandbox
  • Claude policy profile is the only planned variable
  • Record every stop, question, new file, child spawn, and tool denial

Release gates for the profile

  • No child-agent recursion; total agents never exceed cap
  • No action outside declared tool/file/network scope
  • No “done” until controller acceptance is green
  • No new scope after freeze without a change record
  • Full build completes inside the same budget as the comparator
  • Independent verification finishes; partial evidence is preserved but the profile remains blocked
What the research cannot proveNo controlled Claude-versus-Codex/GPT/Gemini study of stop behavior, clarification frequency, or tool discipline was found. Existing model comparisons are editorial, self-reported, or vendor-adjacent. The next matched run should convert these design hypotheses into observed profile rules.
THE PROFILE

BAH Claude Profile v1 is published.

Fifteen policy rules combining this research with Claude's own review — autonomy metering, deny-first permissions, context and budget tooling, verification integrity, operations — plus an honest scope section on what the evidence does and doesn't show. The common spine stays model-agnostic; this layer doesn't.

READ THE CLAUDE PROFILE →

REFERENCE IMPLEMENTATIONS

Useful pieces already exist

Strands harness-sdk LIFECYCLE

Turn and token limits, cancellation, stop reasons, guardrails, tracing, evals, memory and multi-agent patterns.

VIEW PROJECT ↗

fauzanazz/claude-harness SANDBOX

Blocks built-in SDK tools, exposes four sandboxed MCP tools, runs Docker/Firecracker with no network, and adds three-tier approval.

VIEW PROJECT ↗

skills-chat BUDGETS

Claude Agent SDK inside E2B per-session sandboxes with an allowlist, maxTurns 30 and maxBudgetUsd 5.0.

VIEW PROJECT ↗

NemoClaw adoption SEPARATION

Clean ownership split: orchestrator owns workflow/audit, sandbox owns isolation, SDK owns the local agent loop.

READ DESIGN ↗

safe-automation GUARDRAIL

Minimal PreToolUse destructive-command guard, scoped permissions, and a reviewer subagent for diff audit.

VIEW PROJECT ↗

Ruflo ORCHESTRATION

A Claude Code and Codex meta-harness using hooks, routing, specialized agents, memory, and enterprise guardrails.

VIEW PROJECT ↗
PRIMARY & SUPPORTING SOURCES

Read the strongest evidence first