# Audit guarantees belong in the harness

[Journal](/journal/)

July 15, 2026 · [evidence](/journal/#evidence)



A public-data evaluation shows why deterministic contracts and their audit artifacts should surround a replaceable model boundary.

![A removable model module sits inside a technical harness linked to a manifest, schema, validation gate, and recorded trace.](/_astro/audit-guarantees-belong-in-the-harness.D23mhtmM_Z236sGu.webp)

Audit guarantees should live in versioned code around a replaceable model boundary. Prompts can request compliant behavior. A [harness is the surrounding software](https://arxiv.org/abs/2607.08028) that supplies tools and rules, records what happened, and checks the result. It can enforce source boundaries, routing, output schemas, and trace hygiene, then leave an artifact when the model gets them wrong. That difference gives operators something durable to review.

## A contract pass is not a perfect model output

The authors tested a public-data slice spanning [five Korean corporate groups and 25 listed companies](https://arxiv.org/abs/2607.08028). Across [270 composition-boundary runs using three hosted models](https://arxiv.org/abs/2607.08028), every harness-enforced contract held under model substitution.

That result does not mean every model output passed. The paper reports [model-composed failures](https://arxiv.org/abs/2607.08028), which validators caught and recorded before the output crossed the contract boundary. The guarantee belongs to the enforcement path: deterministic code rejects or transforms a violation and preserves evidence of what happened. A model-side pass is one possible event inside that path, not the definition of success.

For an operator, the durable boundary is concrete: code defines the checks, manifests bind allowed sources and entities, and schemas define acceptable output. An [audit trace records the sources, decisions, and validation results](https://arxiv.org/abs/2607.08028) behind an answer. Any hosted model can then be replaced without asking a new prompt to inherit the old model’s institutional memory.

## Prompting asks; the harness decides

The ablation [holds the model fixed and varies the enforcement layer](https://arxiv.org/abs/2607.08028) across 120 runs per condition: 40 scenarios repeated three times. Utility counts runs answered rather than blocked. It is separate from contract compliance, which is why prompt-only output can retain utility while admitting violations. These values belong to the fixed public-data study rather than to production traffic.

Enforcement layer

Reported contract outcome

Reported utility

Prompt only

[Recommendation-language and internal-trace-leakage violations reached the reader](https://arxiv.org/abs/2607.08028)

[120/120](https://arxiv.org/abs/2607.08028)

External guardrail

[Blocked those violations but over-refused](https://arxiv.org/abs/2607.08028)

[88/120](https://arxiv.org/abs/2607.08028)

Code-owned harness

[Blocked those violations while preserving the study's full utility](https://arxiv.org/abs/2607.08028)

[120/120](https://arxiv.org/abs/2607.08028)

The external guardrail shows that blocking is only half the job. Its [88/120 utility score trails the harness’s 120/120](https://arxiv.org/abs/2607.08028) because enforcement detached from application semantics can refuse useful work. Code owned with the application can validate the specific contract and retain the response that satisfies it.

## Keep the evidence boundary narrow

This preprint is the authors’ public-data evaluation, not independent proof of production performance or universal generalization. Its fixed slice does not establish that the same contracts, utility, or failure rates will transfer to another workload. Passing the [specified contracts does not establish the correctness of the underlying investment claims](https://arxiv.org/abs/2607.08028) or the investment quality of the briefings. The study does establish a testable engineering pattern: keep deterministic guarantees and audit artifacts in the versioned harness, keep source-backed claims authoritative, and keep the model replaceable.

The paper’s authors, the model providers, and the studied companies are neither Muniment customers nor endorsers.

## Sources

1.  [arXiv — From Prompts to Contracts: Harness Engineering for Auditable Enterprise LLM Agents](https://arxiv.org/abs/2607.08028) arxiv.org

## Continue reading

[All publications](/journal/)

evidence · Jul 15, 2026

### [Mobile inference needs phase-aware scheduling](/journal/mobile-inference-needs-phase-aware-scheduling/)