I was on a call with a partner last week, and about twenty minutes in, someone asked the question every one of these conversations eventually gets to: if we already have an agentic harness — Bedrock, LangGraph, whatever it is — why do we need a separate product sitting alongside it?
It's a fair question. It's also the question that answers itself once you look at what a harness is actually built to do, and what it isn't.
The harness market is already spoken for
AWS gives away Bedrock Agents. Google gives away Vertex Agent Builder. OpenAI ships the Agents SDK for free. None of them are selling the harness — they're selling the compute underneath it, and the harness is the loss-leader that gets you there. LangChain and LangGraph have the developer mindshare that took years to build.
There is no version of AutoPIL that outspends a hyperscaler subsidizing its own harness to sell tokens. Trying would mean competing on the one axis where we have no structural advantage, and abandoning the one axis where we do. So the real question isn't "why doesn't AutoPIL build a harness" — it's "what does a customer's harness structurally not do, no matter which one they picked."
Enterprises don't run one harness. They run all of them, badly integrated, at once
This is the part that should have been obvious to me faster. Every large enterprise I've walked into — including the ones our partners are advising right now — has one team on Bedrock, another building with LangGraph, a third doing something custom with MCP because nobody told them not to. That's not a transitional state on the way to standardization. That's the permanent condition of a company big enough to have more than one AI team.
A governance layer that only works inside one harness is dead on arrival in that environment. It works for exactly the team that adopted it and nobody else. A governance layer that plugs into any harness — SDK guard, gateway, sidecar, doesn't matter — is the only design that survives contact with how enterprises actually build. That's the first real answer to "why a separate product": the harness is per-team, and governance can't be.
The independence is the point, not a limitation
Here's the argument that actually landed with the partner in that room, because it's their own logic: if the thing enforcing the policy also owns the execution environment, it's marking its own homework. Nobody accepts a company auditing itself. Nobody accepts an OS vendor's firewall as sufficient security posture on its own. The credibility of an enforcement layer comes specifically from not being part of the thing it enforces against.
AutoPIL sitting outside every harness, watching the one moment that matters — an agent about to touch real data — is what makes the audit trail worth showing to a regulator. A harness that also does governance is a harness grading its own test.
That's the second answer: even if a customer standardized on a single harness tomorrow, they still wouldn't want that harness auditing itself.
Harnesses are still moving targets
LangGraph, the Agents SDK, MCP — none of these are stable, mature interfaces yet. They're all shipping breaking changes on a timescale measured in months, not years. If governance lived inside the harness, every one of those version bumps would be an existential risk to it. Sitting at the data boundary instead of inside the harness means AutoPIL keeps working no matter which of these frameworks a customer picks, drops, or replaces next year. That's the third answer: a separate product outlives any one harness choice the customer makes.
The honest version
I don't think "why not build it into the harness" is actually the interesting question anymore. I think the interesting question is whether the market believes governance has to be independent of execution to mean anything — the way audit has to be independent of the thing being audited. I believe it does. Every partner conversation I've had that got past the demo stage eventually arrived at the same place: they didn't want a bigger platform. They wanted the one thing they could point to and say, with evidence, that it actually happened this way and nothing else touched that data first.
That's a narrower job than building a harness. It's also a harder one, and it's the one worth doing.
Anil Solleti is the founder of AutoPIL, a governance-first agentic AI platform for regulated enterprises, and a partner at VibrantCapital.ai.