The governance layer point is where most enterprise agent implementations fall apart. You can build a capable agent in a weekend. Building the harness that makes it safe to run autonomously in a production environment takes months.

Security, identity, audit trail, escalation paths - none of that comes with the agent. I've been thinking about this as two separate products: the agent itself and the scaffolding that makes it trustworthy. Most teams conflate them and then wonder why sign-off is slow. Where do you draw the line between what belongs in the harness versus the agent's system prompt?