A retail service agent scored 14.9 points higher in September without anyone retraining the model underneath it. The gain came from rewriting prompts and inserting guarded intercepts at the tool boundary, a layer with a name in the research literature and none in any procurement document: the harness. Retail buyers spend their leverage on the model, which is the one component their vendor did not build and they cannot tune.

The paper behind that number held the model constant and searched only the software wrapped around it. Beyond Prompts: Measuring and Optimizing LLM Tool-Agent Harnesses, posted to arXiv on 4 September by Cen Mia Zhao and five co-authors, restricted its optimizer to prompts and tool-boundary middleware and barred any rewrite of the agent’s execution logic. The domain that produced the lift, τ²-Retail, handles order management, returns and product inquiries, scored against a written policy the agent must follow. It is the nearest thing research has to a contact-centre floor. Nothing about the improvement required a new model, a new licence, or a new rate card.

Harness choice also decides what an agent costs to run, and the spread is not marginal. The Scaffold Effect in Coding Agents, by Naman Vats and Oleg Golev, is preliminary work still under review at ICML’s DL4C workshop; it ran two models across three open-source harnesses on a stratified subset of Terminal-Bench Pro and found up to a 40x difference in tokens per solved task. That is the gap between an agent programme that clears its business case and one that quietly does not. Pass rates for the same model across those harnesses moved by zero to eight percentage points, with bootstrap confidence intervals covering zero for every comparison but the widest. A retailer bargaining over token rates while the vendor picks the scaffold is arguing about the wrong decimal place.

Model portability is the clause that fails first. LangChain lifted its coding agent 13.7 points on Terminal-Bench 2.0 by changing only the harness, with the model pinned to GPT-5.2-Codex. What it changed is shaped around one model’s habits: middleware that counts repeat edits to a file and prompts the agent to reconsider, a hook that blocks the exit until verification runs, injected warnings about the time budget. A single test run of Claude Opus 4.6 on an earlier version of that harness returned 59.6%, which LangChain attributed to never having run its improvement loop for that model. Retail contracts reserving the right to switch model vendors are reserving the right to inherit someone else’s tuning. Swapping the model is cheap; re-tuning the harness around it is the project.

The vendor’s product is the harness — the model is the part it buys wholesale from someone else.

Any benchmark score a vendor shows a retail buyer describes a harness-model pair, not a model. Princeton’s Holistic Agent Leaderboard reported that an updated scaffold running Opus 4.5 substantially outperformed the scaffold it replaced, and after correcting several grading errors, declared CORE-Bench solved. HAL names procurers as one of the four groups it serves, which makes that finding a procurement signal, not just a research note. The position paper Stop Comparing LLM Agents Without Disclosing the Harness formalises the pattern as the Binding Constraint Thesis: among models of comparable frontier capability, harness-induced variance can exceed model-induced variance, to the point of reversing which model ranks higher. Its authors ask that comparisons without disclosed harness specifications be treated as incomplete and potentially misleading. Retail procurement is doing the reverse, reading vendor scorecards as evidence about models.

Middleware also sets how much of a retailer’s estate the agent can reach. Scores Are Not Decisions, an arXiv paper from July, treats tool acquisition as a stopping problem: a relevance ranking tells an agent which tools matter, not how many are worth the cost, context load and privacy exposure. Evaluated across five tool-use domains including τ-bench Retail, its method exposed the agent to 37% fewer tools than full access while holding task success comparable. In a live deployment that is the difference between an agent that reaches the order database and one that also reaches the payment record and the loyalty profile. The exposure ceiling is a middleware setting, invisible to a security review that asks which model the vendor licensed.

The strongest case against all of this is that the harness is scaffolding around a temporary weakness. LangChain says as much, calling its loop detection and forced verification design heuristics built around today’s model shortcomings that it expects to dissolve as models improve. The disclosure paper concedes the boundary, confining its thesis to models of comparable frontier capability; a vendor holding a genuinely superior model would make model choice the right thing to negotiate.

That condition looks fragile in retail customer service. The vendors selling into that market tend to license comparable frontier models at similar price points, which is precisely the condition under which the Binding Constraint Thesis applies. Where two vendors are effectively reselling similar models, the harness is what actually separates them, and the September paper’s least comfortable result is that some optimizers bought large average gains with brittle configurations, which is why it reports worst-condition lift beside the mean.

Sierra, whose researchers publish the retail benchmark everyone quotes, priced its own product this way as of late 2024. Its outcome-based model charges for a resolved conversation and, in most cases, nothing when it fails, which is a bet on its own harness and an indifference to whose model sits inside. Buyers can take the same position: a contract can set a token-per-resolution ceiling, demand the harness disclosure the position paper specifies, require re-tuning on any model change, and cap the tools the agent may acquire. None of those clauses requires knowing which model was licensed. The model is the part any rival can buy this afternoon; the harness is the part the vendor spent the time building. Regional grocers renting Instacart’s assistant, as we reported earlier today, are renting the second and bargaining over the first, and that is a habit rather than a constraint.