01The AI harness
The harness between intent and consequence.
Cazi sits between an AI agent and the real world. The agent declares an intent; Cazi runs it as a recorded, replayable task inside limits a person set, and keeps every decision on the record.
Act
An agent speaks MCP and picks a declared workload, never a free shell. The spec fixes how it runs; the agent only chooses which. Steps chain into pipelines, one step's output the next one's input.
Contain
Each agent carries a reviewed allowlist and a scope, and an empty list means no tools. Goals and plans are checked before anything runs. Circuit breakers pause a run before it loops or overspends.
Account
Every task keeps its spec, events, logs and exit code. Every unit of work names who did it and for whom. The audit trail is hash-chained and verifiable by anyone you hand the key to.
Nine mechanismsWhat makes it a harness
- 01Intents, not instructions
- Tools are declared workload specs the agent selects from. The agent decides what fits the intent; the spec decides exactly how it runs, on which node, with what limits.
- 02Pipelines and templates
- Chain containers so each step's output feeds the next. Save a working spec as a template with a target placeholder, and the next run reuses it instead of rewriting it.
- 03Allowlists that start empty
- An agent may call only the tools named for it, with arguments inside its scope: access level, images, nodes, connections, threads. Every edit is a reviewed, immutable version, pinned for the life of a run.
- 04Goals the agent cannot write
- A person sets the objective, success criteria, constraints and budget. The agent must propose a plan before it changes anything, and a call that serves no planned step is flagged as drift.
- 05Circuit breakers
- Tokens, turns, tool calls, wall clock, repetition, failures, drift and daily spend each have a ceiling. When one trips, the run pauses and asks a person instead of burning more.
- 06Delegation only narrows
- An agent may hand work to another, but the child inherits no more than the parent had. Budgets count across the whole tree, and no child outlives its parent.
- 07Credentials that die with the turn
- A run acts under a per-turn credential, revoked the moment the run stops. Model turns execute on workers that hold no database, no provider key and no long-lived secret.
- 08Learnings are advice, never authority
- Every failure is captured. A person promotes it to a pattern that warns about, or blocks, the next matching submission. Agents may propose lessons; only people approve them.
- 09Nothing anonymous, nothing unrecorded
- Every task, run, schedule and catalog item names the actor, the accountable person and the route in. Activity is hash-chained per tenant, and each workload carries a signed identity anyone can verify.
- Schedules
- Signed webhooks
- Output sinks
- Threads
- Leased database credentials
- AI analysis on every finished task
- Replay, as is or with new context
- Multi-tenant