When an AI agent "does" something, who actually does it?
What's really going on when an AI agent takes an action.
People say this all the time. Claude edited the spreadsheet. ChatGPT booked the table. The agent ran the script.
Strictly speaking, the model did none of those things. It can't. All a model can do is write text.
So who pressed the button?
An agent is really two programs working together:
Harness: the program wrapped around the model that does the real-world work. Claude Code, Cowork and ChatGPT's agent mode are all harnesses.
You ask: "How many files are in my Downloads folder?"
Tool call: a request the model writes asking the harness to do something for it. It's like a waiter writing your order on a ticket. The kitchen does the cooking.
The model never touches your files directly. Everything goes through the harness.
The permission prompt is the harness asking you. When Claude Code pops up "Allow this command?", the model has asked and the harness is checking with you before it acts.
The rules that really hold live in the harness. Permissions, blocked commands and hooks are enforced by the harness, so the model can't argue its way past them (see "Why AI ignores your instructions").
The model only knows what the harness tells it. If the harness pastes back an error, the model sees an error. If it pastes back nothing, the model sees nothing, and may carry on as if all went well (see "When AI assumes a step worked").
The same model can feel careful in one app and reckless in another.
That's mostly the harness: which tools it offers, what it allows without asking, what it pastes back, how it cleans up the desk on long jobs.
Drew Breunig puts it bluntly: a lot of what makes an agent good or bad lives in the layers around the model, not in the model itself.
Each lap of the agent loop (see "When an AI agent says it's done, check") is really this:
model asks → harness acts → harness reports back → model reads → model asks again
A task that takes Claude Code five minutes might be 40 or 50 of these laps. Each lap puts more on the desk (see "Why your AI usage runs out so fast").
Read the permission prompt as a question from the harness. It's telling you exactly what's about to happen. That's your best moment to say no.
Put hard limits in the harness, not the chat. If something must never happen, use the app's permission settings. Don't rely on asking the model.
When it says it did something, ask to see what the harness reported back. "Show me the output of that command."