For builders operationalizing agentic work.

The approval ledger: three harnesses now say who approved each action, and one of them made the decider a model

Week 43 of 2026 · October 24, 2026

Big read

Put together, this week's harness releases describe one control: a ledger that records who approved what (a person, a policy or a model), written in a format a SIEM (security information and event management system) already ingests, with a default of deny when the ledger cannot be written. Agent Techniques calls it the approval ledger. It is not new this week: W41 carried Copilot CLI 1.0.96's decision timeline, which records whether a human, Assisted Permissions, policy or an unattended fallback made each permission decision, and Claude Code's ceiling field naming the organisation-required approval. What W43 added is the export, the enforcement and the inheritance defaults. Claude Code 2.1.304 through 2.1.310 added a decider: "person" value that a mod (a Claude Code extension that can inspect and veto tool calls) can return from tool.check so that only the interactive permission dialog, not a policy or the model, can approve that action; emitted a claude_code.safety_event OpenTelemetry (OTel, the open standard for traces and metrics) record for every tool call stopped, prompted or bounced; made split-pane teammates (parallel sub-sessions sharing one terminal) inherit the leader's deny rules; and fixed a sandbox leak in which shell startup files ran outside the sandbox (the agent-capabilities table carries the version of each). NVIDIA's OpenShell 0.1.5 added an opt-in push mode that delivers policy changes to running agents in about 100 ms (polling, up to 10 s, remains the default), exports its audit stream as OCSF (Open Cybersecurity Schema Framework) events over OTLP (the OTel wire protocol), and now denies egress to any endpoint whose descriptor the network broker cannot verify instead of falling back. GitHub Copilot CLI 1.0.100 through 1.0.104 is the leg that points the other way on two counts, and the ledger has to record both. Assisted Permissions, which left experimental mode in 1.0.104, is a model judge that decides routine permission prompts (1.0.101 added an assistedApprovalInstructions setting to steer it, and reserved explicit human approval for extension capability requests), so a run under Assisted Permissions has a non-person decider on most of its actions and the ledger must say so. And 1.0.100 flipped the sandbox to allow local-network access by default, so commands can reach localhost and private-network services unless an administrator reviews and tightens the new posture; the one default that did move in the restrictive direction was 1.0.102 making subagents honour the parent's custom and MCP (Model Context Protocol, the open standard agents use to call tools) tool approvals rather than re-prompting.

The reason the ledger is this week's technique is that unattended agent runs just got cheaper, and this issue's expectation is that operators will respond by leaving more of them unwatched. OpenAI's developer changelog added a 12-hour prompt-cache option: writes cost 2.5x list (against 1.25x for the 30-minute default) and reads 0.1x, or 0.05x on GPT-6.1 Sol. On the default tier a prefix written once and read nine times costs 2.15x a single uncached pass instead of 10x (OpenAI's own example); on the 12-hour tier the same loop costs 3.4x (2.95x on GPT-6.1 Sol), which still pays for itself once the prefix is reused across sessions rather than within one. The TurnCost paper (arXiv 2610.15093) measured what that means on 600 public coding-agent trajectories priced under near-ideal cache-aware billing: 98.6% of input tokens were served from cache, flat-rate token counting overstated the cost of the loop by about 7.1x, and the number of turns explained 84% of the variance in bill against 4% for observation size. The paper's own thesis is that the turn, not the token, is the unit to budget, with its own caveat that cutting turns does not guarantee the implied saving if the prefix stops being reused. The Application Layer carries where the saved money lands; this publication's concern is what it buys, which is more turns per dollar and therefore more unattended turns, each of which is an action nobody watched. Trail of Bits supplied the week's measurement of what reviewed-but-unverified merges cost, a self-audit with published denominators rather than an independent study. It audited every Patch the Planet patch (OpenAI's open-source security-patching programme) its own engineers had authored with coding agents and maintainers had merged: 21 of more than 130 merged pull requests introduced a regression (16 functional, 1 performance, 4 build or test; none broke a security protection), identified from 58 agent-generated candidates in one run, about 36% precision. Its regression-hunt plugin then produced 25% fewer false positives than a baseline Codex 'review the PR for regressions' agent on the same 21 known regressions, with a 95% confidence interval of 14-38% on that reduction. About one in six patches that passed human review broke something; the regression rate itself is a point estimate with no published interval. (OpenAI's $1B of subsidised access to Daybreak, its trusted-access cyber model, for defenders, announced the same day, is a separate commitment and not the programme these patches came from.)

The harness-side evidence this week says the technique is cheap and the alternatives are not. Two practitioner studies posted to r/LocalLLaMA (grade 3, reproducible, not peer-reviewed) used different small models and should be read as two datapoints, not one. A Hugging Face engineer's single-tool IPython harness on Qwen3.5-9B went from 70% to 95% task completion on Terminal-Bench Lite (a reduced set of terminal tasks) after a ~40-line regex normaliser scrubbed nondeterministic tool output, while tokens per attempt fell from about 130k to 50k. A second operator ran ten harnesses on Qwen3.5-4B across five tasks: 6 of 10 passed all five, there were zero malformed tool calls in 50 runs, the dominant failure was byte-exact edit mismatches, the runtime spread between fastest and slowest harness was 11x (1m36s against 17m43s) on identical hardware, and Codex CLI never reached the model because the local server's translation of the Responses API into chat messages violated the model's system-message-first template. Google Research's Harness2 (arXiv 2610.14224, submitted October 9 and surfaced on r/LocalLLaMA and Hacker News this week) is the vendor-run counterpart: eight harness components (system prompt, guardrails, memory, tool guidance, subagents, skills, scripts, plugins) that add up to 11.5 points on Google's WorkBuddy-Bench, 4.5 on JobBench and 11.8 percentage points on its LAB suite with the model held constant. None of those gains require a bigger model; all of them require the operator to own the harness, which is the same precondition the approval ledger has. Codex CLI 0.164.0 added ten numbered /presets slots for reusable prompts and slash commands, inline arguments for /model and /permissions (model, effort, speed, permission profile), enterprise MCP authentication through account-level grants rather than per-developer tokens, credential masking in remote Bash and Zsh snapshot sessions, and compaction fixes so a failed compaction (summarising the conversation to free context) no longer corrupts history. Claude Code's MCP Tasks and Elicitations beta (protocol revision 2026-07-28; CLI, Agent SDK and GitHub Actions only) lets a server run a long job that survives the client and ask the user a structured question mid-task, the first protocol-level primitive for a person to enter an unattended run. GitHub's usage API began reporting totals_by_client, attributing requests to claude_code, codex, opencode and zed among others, so an enterprise can for the first time see from the vendor's side which harness its developers run.

What to do differently, by mode. In Chat, nothing changes this week except that Antigravity CLI 1.4.6 now blocks sandboxed reads of ~/.docker, ~/.kube and ~/_netrc without an explicit grant and 1.4.4 keeps tool declarations in the cache prefix across /compact, so a chat session that escalates into tool use no longer leaks cluster credentials or re-pays the cache write; Gemini CLI 0.65.0 separately enforces read-only workspace settings in untrusted folders. In Cowork, turn on the safety-event telemetry and route it to the SIEM the security team already watches, and if you run Copilot CLI, read Assisted Permissions as a model decider in that ledger; the goal this month is a count of person-approved versus policy- or model-approved actions per workflow, not a block rate. In Build, write the approval policy as a committed file (Claude Code settings with deny rules, or an OpenShell policy) reviewed like code, and run Trail of Bits' regression-hunt method on your own merged agent patches before trusting the acceptance rate. In Automate, do not grant unattended runs to any harness that cannot write the ledger: require deny-on-unverifiable egress (OpenShell's default), person-only deciders for the action classes that matter (deploys, payments, deletions), an elicitation path (MCP Tasks) for the agent to stop and ask, and an explicit check of the network default, because one of the three harnesses loosened it this week.

Technique of the week

Automate

The approval ledger: person-only deciders, safety-event telemetry and deny-on-unverifiable egress for unattended runs

Record every permission decision an agent run makes with the identity of the decider (a person, a policy or a model judge), emit each blocked or escalated action as a structured security event a SIEM already ingests, make child agents inherit the parent's restrictions, and default to deny when the ledger cannot be written or the destination cannot be verified. The technique is older than this week (W41 carried the first harness artefacts that record who authorised each action; change management has done this for human operators for decades). W43 added the telemetry export, the enforcement primitive and the inheritance defaults, and a counter-example (Copilot CLI's local-network default) that shows why the ledger has to be checked against each release.

Cache pricing made unattended turns cheaper (one write plus nine reads at 2.15x a single pass on OpenAI's 30-minute default tier, 3.4x on the 12-hour tier; 98.6% of coding-agent input served from cache per TurnCost), and Trail of Bits' self-audit found that about one in six of its agent-authored patches merged under human review introduced a regression. This issue's expectation is that cheaper turns produce more unwatched ones, and cheap turns plus reviewed-but-unverified merges is the failure mode; the ledger is the control that lets an operator say, for each action, whether a person approved it, and it costs an OTel exporter and a config file. Boards and auditors are going to ask for exactly this record the first time an unattended agent does damage, and the harnesses that produce it now cost nothing extra.

Decider: Every permission decision names who made it, and the harness can enforce that some decisions are a person's alone. Claude Code 2.1.304+ lets a mod return decider: "person" from tool.check so that only the interactive permission dialog or host callback can approve that action (it blocks auto-approval; it is an enforcement setting, not a logged field). The record of who decided exists in Copilot CLI's decision timeline (1.0.96, W41: human, Assisted Permissions, policy or unattended fallback) and, for blocked and prompted actions, in Claude Code's safety_event. Copilot CLI's Assisted Permissions, out of experimental in 1.0.104, is a model judge steered by assistedApprovalInstructions, which the ledger must record as a non-person decider; explicit human approval is retained only for extension capability requests. Classify action types (deploy, payment, delete, external send) that require a person decider and reject the run if the harness cannot enforce it.
Safety event: Each blocked, escalated or denied action is emitted as a structured telemetry record rather than a log line. Claude Code 2.1.307 emits claude_code.safety_event over OTel for every tool call stopped, prompted or bounced; OpenShell 0.1.5 emits OCSF 1.8 events over OTLP, including authentication events for rejected requests. Route both to the SIEM the security team already runs so agent actions are correlated with everything else, and alert on the ratio of policy- or model-approved to person-approved actions per workflow, not just on blocks.
Inheritance: Child agents inherit the parent's restrictions. Claude Code 2.1.309 fixed split-pane teammates not inheriting the leader's --tools and deny rules; Antigravity CLI 1.4.6 applies per-conversation approvals across the main agent and subagents. Copilot CLI 1.0.102 made subagents honour the parent's custom and MCP tool approvals instead of re-prompting (which trains people to click through): that is allowance inheritance, which removes a prompt and therefore has to appear in the ledger as the parent's decision carried forward. Audit the subagent and fork paths of your harness for silent inheritance of everything, which was the state of several harnesses two weeks ago.
Default deny on the unverifiable: When the harness cannot verify the destination or cannot write the ledger, it denies. OpenShell's network broker now refuses egress to any endpoint whose descriptor it cannot verify instead of falling back, binds hostname policy to supervisor-controlled DNS, and can push policy updates to running agents in about 100 ms (opt-in); Claude Code 2.1.309 closed the startup-file leak that let shell initialisation run outside the sandbox. The counter-example is in the same week: Copilot CLI 1.0.100 flipped its sandbox to allow local-network access by default, so an operator who assumed a network boundary now has to set one. A run that proceeds without a ledger entry, or on a network default nobody reviewed, is the thing the control exists to prevent.
Policy as a committed artefact: The approval policy lives in version control, reviewed like code. Claude Code's settings file with deny rules and OpenShell's policy files (whose risky diffs its formal prover flags for human review) are the artefacts that do this today. Codex CLI 0.164.0's /presets are ten numbered slots for reusable prompts and slash commands, with permission profiles selected through inline /permissions arguments; they are a convenience for developers, not a committed policy, and the release notes do not describe a repository-level artefact. The ledger is only auditable if the policy that produced each entry is itself diffable.
Entry point for a person: The unattended run needs a structured way to stop and ask. Claude Code's MCP Tasks and Elicitations beta (protocol 2026-07-28; CLI, Agent SDK and GitHub Actions only) lets a server run a long task that survives the client and pose a typed question mid-run; in non-interactive sessions Claude Code cancels tasks that request input rather than guessing, which is the right default. Copilot CLI's explicit-approval path for extension capability requests and the credit-request flows the Application Layer documents are the same primitive at different layers. Without it the agent's only options are to guess or to fail, and cheap turns bias it toward guessing.

Claude Code 2.1.304-2.1.310: decider: "person" on mod tool.check (person-only approval); claude_code.safety_event OTel event (2.1.307); teammates inherit deny rules and sandbox startup-file leak fixed (2.1.309)
NVIDIA OpenShell 0.1.5 (October 20): OCSF 1.8 events over OTLP; deny on unverifiable endpoint descriptors; opt-in ~100 ms policy push
GitHub Copilot CLI 1.0.100-1.0.104: Assisted Permissions (a model judge) out of experimental; subagents honour MCP approvals (1.0.102); sandbox allows local network by default (1.0.100), the week's counter-example
Claude Code MCP Tasks and Elicitations beta (October 23): long-running server tasks that survive the client and typed mid-run questions to the user

Sources anthropics/claude-code releases and changelog; github/copilot-cli releases and changelog; NVIDIA/OpenShell releases; openai/codex releases; Claude Code MCP documentation

New agent capabilities

2026-10-23 · Anthropic · Automate

Claude Code 2.1.304-2.1.310 and MCP Tasks / Elicitations beta

A mod can return decider: "person" from tool.check so only a human dialog can approve that action (2.1.304); every tool call stopped, prompted or bounced by a permission rule, auto mode, hook or sandbox is emitted as a claude_code.safety_event over OTel (2.1.307); Code Review gains Quick, Standard and Deep levels; 2.1.309 fixes sandboxed Bash running shell startup files outside the sandbox, sandboxed commands editing --mcp-config, denyWrite globs missing symlinked paths, Edit deny rules missing Bash redirects, and teammates not inheriting the leader's deny rules. MCP Tasks let a server run a long job that survives the client and Elicitations let it ask the user a typed question mid-task (protocol 2026-07-28; CLI, Agent SDK and GitHub Actions only).

The person-only decider and the safety event are the enforcement and the record halves of the approval ledger in the harness most enterprises already run; the safety event is off until an operator wires the OTel exporter, and the decider only covers mods that opt in. The 2.1.309 batch is the reminder that the sandbox boundary had holes a week ago: upgrade past it before enabling teammates. MCP Tasks is the first protocol-level primitive for a person to enter an unattended run, which makes a deny-by-default posture survivable for long jobs because the agent can stop and ask instead of guessing.

Sources anthropics/claude-code releases (v2.1.309); Claude Code changelog; Claude Code MCP documentation

2026-10-23 · GitHub · Automate

Copilot CLI 1.0.100-1.0.104 and the Copilot usage API totals_by_client

1.0.100 flips the sandbox to allow local-network access by default; 1.0.101 adds an assistedApprovalInstructions setting to steer the Assisted Permissions judge and reserves explicit human approval for extension capability requests; 1.0.102 makes subagents honour the parent's custom and MCP tool approvals; 1.0.104 makes Assisted Permissions available without experimental mode. GitHub's usage API now reports totals_by_client, attributing model requests and tokens to clients including opencode, claude_code, codex and zed.

Two of the three Copilot CLI changes loosen rather than tighten, and the W42 control gap (no default network boundary for autopilot) is wider, not closed: the sandbox now reaches localhost and private-network services unless an administrator reviews the new default. Assisted Permissions is a model judge that reduces human prompts, so the ledger must record it as a non-person decider; the person-only path survives for extension capability requests. The usage API change is the quieter one with the larger consequence: an enterprise can now see from GitHub's side which agent harnesses its developers run, which is the measurement to take before standardising the ledger on one of them.

Sources github/copilot-cli releases (v1.0.104-0) and changelog; GitHub Changelog (October 23)

2026-10-20 · NVIDIA · Automate

OpenShell 0.1.5

An opt-in push mode delivers policy changes to running sandboxes in about 100 ms (polling, up to 10 s, remains the default); the audit stream is exported as OCSF 1.8 events over OTLP, with authentication events for rejected requests; hostname network policy is bound to supervisor-controlled DNS; and the network broker now denies on unverifiable descriptors instead of falling back. The release reached 497 points on Hacker News.

OpenShell is the runtime-layer version of the ledger and the strictest default of the three: deny when unverifiable, with a policy update fast enough to revoke mid-run once push is enabled. For a platform team it is the reference design for what a harness-agnostic control plane should emit; for a CISO the OCSF choice means agent events land in the existing detection pipeline rather than a new dashboard. It is the only one of the three not tied to a model vendor's harness; note that OCSF log filenames changed to .jsonl and 0.0.x cannot upgrade in place.

Sources NVIDIA/OpenShell releases (v0.1.5); NVIDIA Technical Blog; Hacker News

2026-10-23 · OpenAI · Build

Codex CLI 0.164.0 and the 12-hour prompt cache

Codex CLI 0.164.0 adds ten numbered /presets slots for reusable prompts and slash commands, inline arguments for /model and /permissions, enterprise MCP authentication through account-level grants instead of per-developer tokens, credential masking in remote Bash and Zsh snapshot sessions, and compaction fixes (a failed compaction no longer leaves partial summaries in history). The API gains a 12-hour cache option at 2.5x write and 0.1x read (0.05x on GPT-6.1 Sol), against 1.25x write on the 30-minute default.

Account-level MCP grants remove the per-developer token sprawl that made connector scopes the W42 attack surface, and the compaction fixes matter for long unattended runs. Presets are prompt slots, not committed policy; the committed-policy artefact is still Claude Code's settings file or an OpenShell policy. The 12-hour cache changes the arithmetic that justifies the technique: a prefix written once and read nine times costs 2.15x a single uncached pass on the default tier and 3.4x on the 12-hour tier (2.95x on GPT-6.1 Sol), against 10x uncached, so overnight unattended runs with prefixes reused across sessions are now priced to happen. Last week's cache-stable harness technique (keeping the prompt prefix byte-stable so cache reads stay cheap) is the way to collect that; this week's ledger is the way to survive it.

Sources openai/codex releases (rust-v0.164.0); OpenAI developer changelog

2026-10-24 · Google · Chat

Antigravity CLI 1.4.4-1.4.7 and Gemini CLI 0.65.0

Antigravity CLI 1.4.6 blocks sandboxed reads of ~/.docker, ~/.kube and ~/_netrc without an explicit grant and applies per-conversation approvals across main agent and subagents; 1.4.4 makes /compact retain tool declarations so the cached prompt prefix is reused; 1.4.7 adds lastUserInput to hook input so a policy can condition on what the person asked, and makes Auto mode ask less often for routine commands. Gemini CLI 0.65.0 enforces read-only workspace settings in untrusted folders and aligns MCP OAuth issuer validation with RFC 9207. The 1.4.7 release is dated October 24, at the research window's close.

Two small defaults that matter at the chat-to-build boundary: a session that escalates into tool use no longer exposes cluster and registry credentials, and the compaction fix extends last week's cache-stability technique to Google's harness. The lastUserInput hook field is a ledger input in miniature: a policy can now record not just what the agent did but what the person asked for. Auto mode asking less often is the same direction as Copilot's judge, and should be re-checked after upgrade.

Sources google-antigravity/antigravity-cli releases; google-gemini/gemini-cli releases

New skills and connectors

2026-10-23 · Model Context Protocol (Claude Code CLI, Agent SDK, GitHub Actions) · Connector

MCP Tasks and Elicitations (beta, protocol revision 2026-07-28)

Servers can run long tasks that outlive the client connection and pose typed questions to the user mid-task; the beta covers the CLI, the Agent SDK and GitHub Actions, not subagents, claude -p, VS Code or the desktop and web surfaces, and servers must opt in.

The first protocol-level primitive for a person to enter an unattended run, and the piece the approval ledger needs for long jobs: a deny-by-default agent that can stop and ask is usable, one that can only guess or fail is not. Server authors should expect the elicitation schema to become the place approval requirements are expressed, and should log the elicitation and its answer as a ledger entry. Operators should know Esc does not stop a background task.

Sources Claude Code MCP documentation

2026-10-23 · Codex CLI · Template

/presets prompt slots, inline /model and /permissions arguments, enterprise MCP account grants

Ten numbered /presets slots hold reusable prompts and slash commands; /model and /permissions take inline arguments for model, effort, speed and permission profile; enterprises grant MCP server access at the account level rather than per developer token.

Account-level grants shrink the connector-scope attack surface W42 documented (per-developer tokens with broad scopes), and are the part of the release a security team should adopt first. Presets move shared prompts out of ad-hoc config, which is useful, but they are not the committed, diffable approval policy the ledger needs; that still lives in Claude Code settings or an OpenShell policy file.

Sources openai/codex releases (rust-v0.164.0)

2026-10-19 · Google Research (open source) · Harness

Harness2 (eight harness components; arXiv 2610.14224)

With the model held constant, Harness2's eight components add up to 11.5 points on Google's WorkBuddy-Bench, 4.5 on JobBench and 11.8 percentage points on its LAB suite; the code is public on GitHub. The paper was submitted October 9 and surfaced on r/LocalLLaMA and Hacker News this week; the results are vendor-run on the vendor's own benchmarks.

The clearest published claim that the harness now contributes more than a model upgrade, from a lab that sells the models. The README notes executor network access is unrestricted and Codex runs with sandbox disabled, so benchmark rubrics must be firewalled before trusting the numbers; treat the gains as a ceiling until an independent run on a public benchmark reproduces them. The Model Pulse excludes it from the tree as a harness.

Sources google-research/harness2 (GitHub); arXiv 2610.14224

2026-10-19 · Hugging Face (open source) · Harness

ipython-harness with output normaliser

A practitioner study posted to r/LocalLLaMA measured task completion rising from 70% to 95% and tokens per attempt falling from about 130k to 50k on Terminal-Bench Lite when a ~40-line output normaliser was added to Hugging Face's single-tool IPython harness, on Qwen3.5-9B.

A grade-3, reproducible result that says a few dozen lines of harness code are worth more than a model upgrade for small-model tool use, and that the token saving (about 60%) is of the same order as the cache saving the week's pricing delivered. For teams running open models on-device (The Model Pulse's edge tier has two new entrants), the normaliser is the first thing to add, before the ledger, because malformed or nondeterministic tool output is the noise the ledger would otherwise record.

Sources huggingface/ipython-harness (GitHub); r/LocalLLaMA (mirrored)

Proof of value

Evidence · Practitioner Report

Trail of Bits (regression hunt across its own Patch the Planet patches) · Security patches authored by Trail of Bits engineers with coding agents under OpenAI's Patch the Planet programme and merged by project maintainers, re-examined for behavioural regressions with a purpose-built detector

21 of more than 130 merged agent-authored pull requests introduced a regression (16 functional, 1 performance, 4 build or test, none breaking a security protection), identified from 58 candidates in one run (~36% precision); the regression-hunt plugin produced 25% fewer false positives than a baseline Codex review agent on the same 21 regressions (95% CI 14-38%).

The week's most important number for anyone approving agent patches: about one in six that passed human review broke something, a self-audit by the firm that wrote the patches, with published denominators, rather than a vendor claim or an independent study. The confidence interval belongs to the false-positive reduction, not to the regression rate, which is a point estimate. The read is not that agents should not patch, it is that the acceptance rate is the wrong metric; the regression hunt is the method to run on your own merged agent PRs, and the ledger is the process-side record that would let you ask which of those merges a person read. The Application Layer's security row carries the product comparison this caveats.

Sources Trail of Bits blog (October 21); trailofbits/skills README

Evidence · Benchmark

TurnCost (arXiv 2610.15093) · Cost accounting of 600 public coding-agent trajectories under near-ideal cache-aware pricing, separating cached from uncached input and modelling bill variance

98.6% of input tokens in the trajectories were served from prefix cache; flat-rate token counting overstated loop cost by about 7.1x relative to cache-aware pricing; turn count explained 84% of the variance in bill and observation size 4%.

The measurement that converts last week's technique into a budgeting rule: price the turn, not the token, and treat the cached ratio as the first number to check in any vendor's cost claim. It is also the basis for this issue's expectation that unattended runs multiply as turns get cheaper, which is why the approval ledger is the control this week rather than next quarter; the paper's caveat is that cutting turns does not guarantee the implied saving. The dataset is coding agents with stable tool and instruction prefixes; assume the ratio is lower for workflows with less stable prefixes until measured.

Sources arXiv 2610.15093

Evidence · Vendor Claim

Zendesk (Employee Service AI Agents early access) · IT and HR requests handled by agents in the help centre, Slack and Teams, packaged by automated resolution

About 300 early-access customers ran 6 million workflow executions in five weeks (vendor adoption figure); the GA packaging includes 10-15 resolutions per agent per month, after which the agent pauses.

The relevance here is the control shape, not the usage figure: an allowance-and-pause meter at the commercial layer is the same shape as the ledger's deny-by-default at the runtime layer, and the two should be designed together so that an unattended agent that hits its allowance stops rather than bills. The Application Layer carries the pricing, the hours-saved estimate and the comparison with ServiceNow.

Sources Zendesk Newsroom; Zendesk Help

Evidence · Practitioner Report

r/LocalLLaMA practitioners (ten-harness comparison on Qwen3.5-4B) · The same small open model run through ten agent harnesses on an identical five-task tool-use set

6 of 10 harnesses passed all five tasks; zero malformed tool calls in 50 runs; an 11x spread in runtime (1m36s against 17m43s) between fastest and slowest harness on identical hardware; Codex CLI 0.163.0 never reached the model because the local server's Responses-to-chat translation violated the model's system-message-first template.

Grade 3 (reproducible, not reviewed), and the useful finding is the spread rather than the zero: on a modern small model the harness, not the model, decides whether a task takes a minute or eighteen and whether it runs at all, which is cost and latency the operator controls. Paired with the ipython-harness normaliser result on a different model (Qwen3.5-9B) and Google's Harness2, it is three independent lines of evidence in one week that the harness layer is where the next gains are, which is also where the ledger lives.

Sources r/LocalLLaMA (mirrored)

Evidence · Confirmed

GitHub (Copilot usage API totals_by_client) · Enterprise attribution of Copilot and third-party agent requests by client

The usage metrics API now reports request and token totals by client, with opencode, claude_code, codex, zed and copilot_cli among the attributed clients, and lists up to 25 named skills, agents and MCP servers.

Confirmed by the published API change rather than claimed, and the first vendor-side measurement of which harnesses an enterprise's developers run. It is the denominator every proof-of-value claim in this section has lacked: before adopting a ledger standard, pull this report and see whether the harness you are standardising on is the one in use.

Sources GitHub Changelog (October 23)

Enterprise readiness

Human Approval

Claude Code can now enforce a person-only approval for a mod's actions (decider: "person"), OpenShell's policy events record every allow and deny, and MCP Tasks gives an unattended run a structured way to ask. Copilot CLI moved the other way: Assisted Permissions, a model judge, is now available outside experimental mode for routine prompts, with human approval retained for extension capability requests. The gap: no harness enforces a person decider for a class of actions by default; the operator must configure it, and in Claude Code it covers only mods that opt in.

Auditability

Safety events are emitted in formats a SIEM ingests without a parser (OTel from Claude Code 2.1.307, OCSF 1.8 over OTLP from OpenShell), and Copilot CLI's decision timeline (W41) names the decider per action. The gap: three ledgers, three schemas; nobody has published a mapping from claude_code.safety_event to OCSF, Copilot CLI's timeline is not exported, and Claude Code's decider setting is enforcement rather than a logged field, so the person-versus-policy count has to be reconstructed from safety events.

Permissioning

Restriction inheritance improved: Claude Code teammates inherit deny rules, Antigravity CLI applies approvals across subagents and blocks sandboxed reads of ~/.docker, ~/.kube and ~/_netrc, and Codex moves MCP authentication to account-level grants. Copilot CLI 1.0.102's subagents inheriting the parent's MCP approvals is allowance inheritance and should be read as such. The gap: fork and subagent paths in harnesses not named here should be assumed to inherit allowances until checked.

Verification

Trail of Bits' regression hunt (about one in six merged agent-authored patches regressed; the regression-hunt plugin cut false positives 25% against a baseline review agent) is the week's only independent verification result and it is a negative one for review-as-verification. The gap: no harness ships a regression detector, Claude Code's Code Review Quick / Standard / Deep levels are a cost knob with no published recall, and the acceptance rate vendors quote measures neither.

Cost

TurnCost's 98.6% cached ratio and ~7.1x overstatement (against near-ideal cache-aware pricing), and OpenAI's 12-hour cache at 0.1x reads and 2.5x writes, mean the turn is the budgeting unit, and this issue expects unattended runs to multiply as a result. The gap carried from W42 stands: no mainstream harness reports the cached-token ratio or the turn count per task to the operator, so the cost the ledger is meant to control is still measured from the provider's invoice after the fact.

Reliability

Harness choice produced an 11x runtime spread on one small model (Qwen3.5-4B, ten harnesses) and a 70%-to-95% completion swing on another (Qwen3.5-9B, one harness with and without a normaliser), and Google's Harness2 adds 4.5-11.8 points with the model fixed. The gap: all three are grade 3 or vendor-run; there is no independent harness benchmark on a public task set, which makes harness selection a measurement each team has to make itself.

Data Access

Claude Code 2.1.309's sandbox fixes and Antigravity's credential-directory protection are closures of paths by which an agent reached data its policy did not cover; Copilot CLI 1.0.100's local-network default is an opening of one, since sandboxed commands can now reach localhost and private-network services unless the administrator tightens it. The gap: sandbox boundaries in the agent harnesses are weeks old and change weekly in both directions; treat the sandbox as a mitigation, keep credentials out of the home directory the agent can read, re-read each release's network default, and prefer account-level grants (Codex) to developer tokens.

Scorecard

As of 2026-10-24

Mode	Leading pattern	Representative tools	Control gap
Chat	Chat sessions that escalate into tool use inherit sandbox defaults that protect developer credentials and preserve the cache prefix across compaction; hooks see the person's last input	Antigravity CLI 1.4.4-1.4.7 (~/.docker, ~/.kube and ~/_netrc protected; /compact keeps tool declarations; lastUserInput in hooks), Gemini CLI 0.65.0 (read-only settings in untrusted folders), Unified Claude Enterprise with Efficient mode (The Application Layer)	Skill provenance and signing across vendors remain absent (unchanged from W42); the new admin cost controls in unified Claude Enterprise are off until November 16; the chat surfaces have no decider record or safety-event export; Antigravity's Auto mode now asks less often for routine commands, which should be re-checked after upgrade.
Cowork	Agents that can stop and ask a typed question mid-task over the protocol, and system-of-record connectors whose per-call price is now a commercial term	Claude Code MCP Tasks and Elicitations beta, Salesforce Headless Platform Interactions on registered agents (The Application Layer), Gainsight free MCP with ARR-indexed pricing (The Application Layer)	Elicitations are CLI, Agent SDK and GitHub Actions only, not desktop or web; the MCP call now carries a cost the harness does not show the user before making it, and no harness exposes the Salesforce multiplier or any connector's rate card at decision time.
Build	Approval and sandbox policy as a committed, diffable artefact; review depth as an explicit cost knob; harness components worth more than a model upgrade	Claude Code settings and deny rules; Code Review Quick / Standard / Deep, Codex CLI 0.164.0 (account-level MCP grants, credential masking in remote shells, /presets prompt slots), Google Harness2 (vendor-run, up to +11.8), Hugging Face ipython-harness with normaliser (70% to 95% on Qwen3.5-9B)	No harness ships a regression detector and review levels publish no recall, so Trail of Bits' one-in-six regression rate on merged agent-authored patches has no in-harness counter; Codex presets are prompt slots rather than committed policy; the cached-token ratio and turn count per task are still not reported to the operator (carried from W42).
Automate	The approval ledger: who decided (person, policy or model judge) per action, safety events in SIEM-native formats, deny rules inherited by child agents, and deny-by-default on unverifiable egress	Claude Code 2.1.304-2.1.310 (decider: person on tool.check; claude_code.safety_event; teammates inherit deny rules), NVIDIA OpenShell 0.1.5 (OCSF 1.8 over OTLP; deny on unverifiable descriptors; opt-in ~100 ms policy push), Copilot CLI 1.0.100-1.0.104 (decision timeline from W41; Assisted Permissions judge out of experimental; subagents honour MCP approvals)	Copilot CLI's sandbox allows local-network access by default from 1.0.100, so the W42 gap (no default autopilot network boundary) is open and wider; Assisted Permissions is a model decider on routine prompts; three ledgers, three schemas, no published mapping; no harness enforces a person decider for a class of actions by default; Copilot CLI's decision timeline is not exported; OpenShell is the only one of the three with deny-on-unverifiable as the default.

Try this

Stand up an approval ledger for one unattended workflow in a week, and run a regression hunt on what it has already merged

Expected outcome: A SIEM-queryable record, for one workflow, of who approved every action the agent took and what it was denied, produced by a policy that lives in version control; a measured regression rate for the agent's past merges to set against its acceptance rate; and a turn-count budget for the workflow that reflects the cache tier you use (2.15x per write-plus-nine-reads on the default tier, 3.4x on the 12-hour tier) rather than list token prices. The number to look at first is the policy-approved share of actions in classes you had assumed a person was watching; if it is most of the total, the policy is wrong, not the agent.

Pick one workflow that already runs without a person watching (nightly dependency updates, ticket triage, a data-pipeline repair loop) and list the action classes it can take; mark deploys, payments, deletions and external sends as person-only.
Upgrade the harness to a ledger-capable release (Claude Code 2.1.309 or later; Copilot CLI 1.0.104 with its decision timeline; or wrap the runtime in OpenShell 0.1.5) and turn on the export: the OTel exporter for claude_code.safety_event, or OpenShell's OCSF stream over OTLP, pointed at the SIEM the security team already uses. In Claude Code, have the mods behind the marked action classes return decider: "person" from tool.check; in Copilot CLI, record Assisted Permissions as a model decider and keep the marked classes on explicit approval.
Write the approval policy as a committed file (Claude Code settings with deny rules, or an OpenShell policy) that requires a person for the marked action classes and denies egress to any endpoint not on an explicit list; have it reviewed as a pull request, not set in a terminal. Check the harness's network default while you are there: Copilot CLI's sandbox allows local-network access by default from 1.0.100.
Check inheritance by hand: start a subagent or teammate from the workflow and confirm it cannot do anything the parent cannot; if it can, the harness inherits allowances and should not run unattended this week.
Pull the last 30 days of merged changes the workflow produced and run Trail of Bits' regression-hunt method on them (the plugin and write-up are public; add a THREAT_MODEL.md and require a live reproduction for every claim); record the regression count next to the acceptance rate you have been reporting.
At the end of the week report three numbers per workflow: person-approved actions, policy- or model-approved actions and denied actions, plus the turn count per task from TurnCost's method; if the second number is most of the total for a person-only class, the policy is wrong, not the agent.

Watchlist

Next two weeks

A published mapping between claude_code.safety_event, Copilot CLI's decision timeline and OCSF, from a vendor or a SIEM integrator

The three ledgers that shipped this week use three schemas; the first mapping makes the approval ledger a cross-harness control rather than three dashboards, and decides whether OpenShell's OCSF choice becomes the common denominator.

Next Copilot CLI releases

GitHub restoring a restrictive local-network default or shipping an administrator policy for the sandbox network posture, and exporting the decision timeline

1.0.100 opened the sandbox to local-network access by default and 1.0.104 made a model judge available outside experimental mode as the approval path for routine prompts; the W42 control gap is wider, and the first release that lets an administrator pin the network boundary and read the judge's decisions out of the harness closes it.

By November 7

Independent reproduction of any harness-layer gain: Harness2 on a public benchmark, or the ipython-harness normaliser and ten-harness runtime spread by a second team

Three lines of evidence this week say the harness is worth more than a model upgrade, and all three are vendor-run or grade 3; one independent reproduction converts harness selection from folklore into a measurement teams can cite in procurement.

Through November

MCP Tasks and Elicitations reaching the Claude desktop and web surfaces, and a second vendor (Codex, Copilot CLI or Gemini CLI) implementing the 2026-07-28 protocol revision

The person-entry primitive is CLI-only and single-vendor today; the ledger's deny-by-default posture is only usable for long cowork tasks once the agent can stop and ask from the surfaces knowledge workers use, and once a second harness implements it the elicitation schema becomes the de facto place approval requirements are expressed.

Next regression-hunt cycle (Trail of Bits or a second lab)

A regression rate for agent patches produced under a person-only decider versus policy or judge approval

The one-in-six rate was measured on patches merged under ordinary human review with no ledger; the controlled comparison is the evidence that would show the approval ledger changes outcomes rather than just records, and it is the number a board will ask for.

Changelog

2026-10-24: Issue 27 published. Technique: the approval ledger (who decided per action, SIEM-native safety events, restriction inheritance, deny-on-unverifiable egress, committed policy, a person-entry primitive), presented as the W41 attribution artefacts (Copilot CLI 1.0.96's decision timeline, Claude Code's ceiling field) plus this week's telemetry export, enforcement primitive and inheritance defaults from Claude Code 2.1.304-2.1.310 and OpenShell 0.1.5, while OpenAI's 12-hour cache and TurnCost's measurements made unattended turns cheap enough to need it. Mode: automate, as the successor to W42's cache-stable harness (build).
Revision cycle 1: the Copilot CLI entries were corrected throughout. 1.0.100 allows local-network access in the sandbox by default; Assisted Permissions is a model judge available outside experimental mode from 1.0.104; subagents honouring MCP approvals shipped in 1.0.102. Claude Code's decider: "person" is described as a tool.check setting that restricts approval to a human dialog, not as a logged field. Codex /presets are described as prompt and slash-command slots, not committed policy bundles. Trail of Bits' 95% CI (14-38%) is attached to the 25% false-positive reduction against a baseline review agent, the patches are attributed to Patch the Planet and Trail of Bits' own engineers, and the regression breakdown (none security-breaking) is added; the Daybreak $1B is carried as a separate commitment. The cache arithmetic names the tier: 2.15x is the 30-minute default, 3.4x the 12-hour tier. The ~/.docker and ~/.kube protection and the /compact fix are attributed to Antigravity CLI 1.4.6 and 1.4.4; the two r/LocalLLaMA studies are attributed to Qwen3.5-9B and Qwen3.5-4B respectively. Two source URLs were corrected to the packet's (Trail of Bits post; GitHub changelog) and the r/LocalLLaMA mirror now points at the article.
Revision cycle 2: Trail of Bits' study described throughout as a self-audit with published denominators (its engineers authored the patches) rather than an independent or third-party measurement; the invented practitioner testimonial at the end of the expected outcome removed; 'cheap enough to be left alone' and 'priced to multiply' restated as this issue's expectation rather than a measured fact; TurnCost's workflow corrected (near-ideal cache-aware pricing, not 'across providers') and its turns-not-tokens conclusion attributed to the paper with its caveat; the Codex CLI failure stated consistently as a system-message-first template violation in the local server's Responses-to-chat translation; Assisted Permissions described as available outside experimental mode rather than as a default path; the version inventory in the first paragraph trimmed with the capabilities table as the fact home; glosses added for mod, Daybreak, Patch the Planet, split-pane teammates and Terminal-Bench Lite; the technique summary shortened; 'actually' removed.
Evidence labels: Trail of Bits' regression hunt and the two r/LocalLLaMA harness studies are practitioner reports (the latter grade 3, reproducible, unreviewed); TurnCost is a benchmark paper, and its ~7.1x is measured against near-ideal cache-aware pricing; Google's Harness2 gains are vendor-run on the vendor's own suites and the paper predates the window; Zendesk's 6 million executions is a vendor adoption figure; GitHub's totals_by_client is confirmed by the published API change. Antigravity CLI 1.4.7 is dated October 24, at window close. No customer case study met the bar this week.
Scorecard: automate leads on the approval ledger; build moves from cache-stable harnesses to policy-as-artefact and harness-over-model evidence; cowork records MCP Tasks and the MCP call becoming a priced commercial term; chat records the Antigravity and Gemini CLI sandbox and compaction defaults. W42 control gaps: the Copilot CLI network boundary is recorded as open and wider (1.0.100 default allows local network); subagent approval inheritance moved in Copilot CLI (1.0.102, as allowance inheritance) and Claude Code (deny rules, 2.1.309); cached-token ratio and turn count not shown to operators, and skill provenance, are carried.
Fact homes: this publication carries the harness releases, MCP Tasks, OpenShell, the cache arithmetic, Trail of Bits' regression hunt, Harness2 and the practitioner harness studies in full; the Application Layer carries the agent meters, the weekly carries where the cache surplus lands, and The Model Pulse carries the edge models the harness studies apply to. Glosses at first use: SIEM, OTel, OTLP, OCSF, MCP, Assisted Permissions, compaction, cache-stable harness. Firewall and public-source checks passed; every source URL is the packet's.