Externalization in LLM Agents: A Unified Review of Memory, Skills, Protocols and Harness Engineering

Core thesis

• Externalization unifies recent agent advances by relocating cognitive burdens into persistent, inspectable, reusable structures that jointly cover competencies required for reliable agency.The paper frames this as a transition logic explaining shifts across memory, skills, protocols, and harness engineering, not merely as engineering convenience [Norman, 1991, Sumers et al., 2024].Source: §1 · p. 5

Motivation

• Practical reliability gains often come from changing the model’s environment—through persistent memory, reusable skills, standardized interfaces, constrained execution, instrumentation, and explicit control logic—without changing base-model weights [Sumers et al., 2024, Wang et al., 2024a, Li, 2025, Luo et al., 2025].An unaided model faces continuity, variance, and coordination mismatches; externalization turns these burdens into forms it can handle more reliably [Sumers et al., 2024, Packer et al., 2023].Source: §1 · p. 5

Harness engineering

• Harness engineering is the runtime layer that unifies memory, skills, and protocols through orchestration, constraints, observability, feedback loops, and control points.The harness is not a fourth externalization dimension; it hosts and coordinates the other three in practice.Source: §1 · pp. 6–7

System-level coupling

• Externalized modules interact systemically: memory competes with skill loading for context, skill traces become memory, and retrieval influences subsequent skill and protocol choices.The harness mediates these couplings, while protocol standardization can improve interoperability yet constrain capability packaging and invocation.Source: §1 · p. 6

Review contribution

• The review contributes a systems-level account of converging memory, skill, and protocol ecosystems, explaining how their convergence reshapes the definition of an agent.It distinguishes this synthesis from component-level surveys and situates it alongside prior work on retrieval, tool use, architectures, interoperability, and CoALA [Gao et al., 2024, Xi et al. [2025], Qu et al., 2024, Wang et al., 2024a, Li, 2025, Luo et al., 2025, Ehtesham et al., 2025c, Sumers et al., 2024].Source: §1 · pp. 6–7

Three externalization dimensions

• Memory externalizes state across time, skills externalize procedural expertise, and protocols externalize interaction structure through selective retrieval, reusable guidance, and machine-readable contracts.Their corresponding transformations are recall to recognition, generation to composition, and ad-hoc communication to structured exchange [Lewis et al., 2020, Park et al., 2023, Packer et al., 2023, Chhikara et al., 2025, Xu et al., 2025b, OpenAI, 2023a, Schick et al., 2023, Wang et al., 2023a, Anthropic, 2025, 2026, Jiang et al., 2026b, Anthropic, 2024, Google Cloud, 2025a, Ehtesham et al., 2025c].Source: §1 · pp. 6–7

2 Background: From Weights to Context to Harness

• The field’s center of gravity has moved from parametric weights through prompts and context toward harness infrastructure, while earlier layers remain foundational.Figure 2 presents this progression across Weights, Context, and Harness from 2022 to 2026; the stages are layered rather than mutually exclusive.Source: Figure 2 · p. 7, §2 · pp. 7–8

2.1 Capability in Weights

• Weight-centric systems offer fast inference, compact deployment, and broad generalization, but tightly couple knowledge, procedures, and policies to a static, difficult-to-audit artifact.Selective updates, personalization, and modular management become difficult, especially for long-horizon tasks requiring persistent state, reliable procedures, and coordinated tools.Source: §2.1 · p. 8

2.2 Capability in Context

• Context-based methods externalize cognition through prompts, reasoning traces, retrieval, and runtime instructions, making frozen models more flexible and cheaper to adapt without gradient updates.However, context is finite, costly, noisy, vulnerable to “lost in the middle,” and ephemeral unless state is externalized elsewhere.Source: §2.2 · pp. 8–10

2.3 Capability through Infrastructure

• Harness engineering extends capability beyond prompt management through persistent memory, tool registries, protocols, sandboxes, orchestration, evaluators, and approval loops.Memory externalizes state across time, skills externalize procedural expertise, and protocols externalize governed interaction, distributing capability across structures that shape what models see, remember, call, and may do.Source: §2.3 · pp. 10–11

2.4 Externalization as the Transition Logic

• Externalization responds to a capability mismatch: models flexibly synthesize over provided information, while memory, procedural repeatability, and governed interaction are more reliably handled by explicit infrastructure.The transition converts recall into recognition, improvised generation into structured composition, and ambiguous coordination into governed contracts, with reliability enforced through harness logic.Source: §2.4 · p. 11

3.1 What Is Externalized: The Content of State

• Memory externalizes four distinct forms of continuity: working context for resumption, episodic experience for reflection, semantic knowledge for abstraction, and personalized memory for cross-session adaptation.These stores differ in temporal properties, retrieval needs, and governance requirements; procedural regularities promoted into reusable guidance belong to the skill layer rather than memory.Source: §3.1 · pp. 11–13

3.2 How It Is Externalized: Memory Architectures

• Memory architectures progress from monolithic context through retrieval storage and hierarchical orchestration to adaptive systems, shifting the central problem from storing history to controlling what is written, retrieved, compressed, and forgotten.The progression corresponds to existence, capacity, organization, and policy, making memory part of the harness control surface rather than a passive prompting appendix.Source: Figure 4 · p. 12, §3.2 · p. 13, §3.2.4 · p. 14

3.2.1 Monolithic Context

• Monolithic context is transparent and effective for short tasks, but scales poorly, suffers summary drift, consumes reasoning tokens, and loses durable experience when sessions end.All relevant history or its summary remains in the prompt, so state disappears with the session and the agent cannot accumulate persistent experience.Source: §3.2.1 · p. 13

3.2.2 Context with Retrieval Storage

• Context plus retrieval storage preserves near-term working state in context while retrieving longer-horizon traces on demand, solving capacity limits but making behavior dependent on retrieval quality.GraphRAG, ENGRAM, and SYNAPSE replace flat similarity search with graph, latent-state, or spreading-activation mechanisms aimed at long-horizon relevance.Source: §3.2.2 · p. 13

3.2.3 Hierarchical Memory and Orchestration

• Hierarchical memory treats stored traces as a managed lifecycle through extraction, consolidation, forgetting, tiered hot/cold storage, and function-specific organization.Resource decoupling increases effective capacity under fixed context budgets, while semantic decoupling aims for more precise retrieval across events, profiles, and world knowledge.Source: §3.2.3 · pp. 13–14

3.2.4 Adaptive Memory Systems

• Adaptive memory systems make modules, routing, or retrieval strategies responsive to experience through evolving memory components, distillation, reinforcement learning, mixture-of-experts gating, and iterative retrieval refinement.Dynamic architectures and feedback-based policies extend hierarchical management by adapting how memory is encoded, stored, retrieved, and controlled during execution.Source: §3.2.4 · p. 14

3.3 Memory Demands of the Harness Eras

• Harness-era memory separates authoritative task state from transient context, links execution traces to skill formation and protocol routing, and requires governed sharing, permissions, conflict resolution, and access quotas.File-centric state abstractions such as InfiAgent use curated workspace snapshots rather than lengthy histories, while memory remains the persistent substrate for planning, execution, recovery, and multi-agent governance.Source: §3.3 · pp. 14–15

3.4 Memory as Cognitive Artifact

• As a cognitive artifact, memory transforms unbounded internal recall into bounded recognition and retrieval, so success depends on making the current decision legible rather than maximizing storage.Stale, over-abstracted, under-abstracted, poisoned, or conflicting memories fail by presenting unusable problem representations, not merely by storing too little or too much.Source: §3.4 · pp. 15–16

4 Externalized Expertise: Skills

• Skills reduce procedural burden by replacing repeated workflow reconstruction with explicit, reusable procedures that lower variance in steps, tool use, and stopping conditions.The burden increases with task length, environmental specificity, and branching decisions.Source: §4 · p. 16
• Rather than mainly expanding available actions, skills change runtime work from inventing a workflow to selecting and following one [Xu and Yan, 2026b, Wang et al., 2026a].Skill artifacts can be discovered, loaded, revised, and composed.Source: §4 · p. 16
• Skills connect memory to action by using retrieved state for selection, protocolized interfaces for tool and subagent binding, and execution traces or reflection for updates [Sumers et al., 2024, Wu and Zhang, 2026].Memory externalizes what has been learned over time, while skills externalize how that experience becomes a reusable operating structure.Source: §4 · p. 16
• Figure 5 presents a skill lifecycle spanning acquisition, artifact packaging, registry-based activation, runtime execution, and boundary conditions that constrain reliability.Acquisition includes expert authoring, trajectory distillation, exploration, self-induction, and composition; artifacts include procedures, heuristics, constraints, and manifests.Source: Figure 5 · p. 16

4.1.1 Operational Procedure

• Operational procedures externalize task structure by specifying steps, dependencies, and stopping conditions, reducing skipped, misordered, or prematurely terminated actions [Hsiao et al., 2025, Nandi et al., 2026].They also support resumption after interruption, handoffs across contexts or collaborators, and state recovery without reconstructing the workflow.Source: §4.1.1 · p. 17

4.1.2 Decision Heuristics

• Decision heuristics externalize local policies such as default choices, escalation rules, and preference orderings, reducing deliberation cost while stabilizing behavior under uncertainty.They encode what to try first, when to back off, what evidence suffices, and which trade-offs to prefer.Source: §4.1.2 · p. 17

4.1.3 Normative Constraints

• Normative constraints make skills governable by embedding testing, scope, access, traceability, and domain-specific requirements into task execution [Chen et al., 2021, Bai et al., 2022b, Wei et al., 2023, Schick et al., 2023, Madaan et al., 2023].They can impose preconditions, block unsafe branches, require validation, and specify completion evidence, making skills carriers of governance as well as capability.Source: §4.1.3 · p. 17

4.1 What is Externalized: Procedural Expertise

• A reusable skill combines operational structure, local decision policy, and acceptable boundaries, distinguishing repeatable task know-how from raw action interfaces or past state.This three-part composition lets skills survive across tasks, contexts, and runs while sitting above action interfaces and beside memory.Source: §4.1.3 · p. 18

4.2.1 Stage 1: Atomic Execution Primitives

• Atomic execution primitives provide reliable function calling, argument construction, and result integration, but they expose only stable access to individual actions.At this stage, the unit is the action primitive rather than an explicit reusable procedure for a broader task class.Source: §4.2.1 · p. 18

4.2.2 Stage 2: Large-scale Primitive Selection

• Large-scale primitive selection enables models to retrieve, rank, and dynamically choose among many tools, but task know-how remains implicit rather than packaged as a reusable procedure.The capability unit remains the tool, even when multi-step behavior begins to emerge.Source: §4.2.2 · p. 18

4.2.3 Stage 3: Skill as Packaged Expertise

• Skill systems compile primitive actions and trajectories into reusable procedural abstractions, libraries, APIs, execution graphs, and domain-specific procedures.These representations support skill-level retrieval, argument instantiation, composition, and failure recovery across tasks.Source: §4.2.3 · p. 18
• Stage 3 represents capability as packaged procedural knowledge that can be loaded, reused, and composed across tasks.Skills capture how tasks should be carried out through reusable procedural organization, rather than merely specifying available actions.Source: §4.2.3 · p. 18

4.3 How Skills Are Externalized

• Skills become reusable capabilities only when their representations and runtime layers support discovery, loading, interpretation, binding, and execution.The runtime must determine when to load a skill, which memory to condition it on, and which tools, files, or subagents to bind.Source: §4.3 · p. 19

4.3.1 Specification

• Structured specifications define a skill’s capability boundaries, applicability, preconditions, constraints, examples, and counterexamples, enabling inspection, revision, discovery, version control, and governance.Specification artifacts such as SKILL.md files and manifests turn procedural expertise into bounded capability descriptions rather than opaque prompting tricks.Source: §4.3.1 · p. 19

4.3.2 Discovery

• Skill discovery matches procedural expertise to task complexity, environmental assumptions, operational constraints, and risk conditions rather than relying only on keyword overlap.Registries and retrieval mechanisms select relevant skills based on task goals, context state, and environmental conditions.Source: §4.3.2 · p. 19

4.3.3 Progressive Disclosure

• Progressive disclosure exposes a skill’s existence first, then loads applicability details and full procedures only when runtime conditions require them.Layered loading matches informational density to task complexity and avoids saturating context with unnecessary detail.Source: §4.3.3 · pp. 19–20

4.3.4 Execution Binding

• Execution binding translates skill specifications into actions by connecting them through an interpretation layer to tools, files, APIs, subagents, protocols, and other interfaces.Tools execute operations, protocols govern their invocation, and skills provide higher-level strategies for combining them; MCP [Anthropic, 2024] supports discoverable and invocable capabilities.Source: §4.3.4 · p. 20

4.3.5 Composition

• Composition makes skills schedulable runtime units that coordinate serial, parallel, conditional, or recursive procedures into maintainable, replaceable, and auditable capability structures.This shifts skills from isolated recipes toward a genuine capability layer for agent systems [Yu et al., 2025].Source: §4.3.5 · p. 20

Authored

• Authored skills remain the most common and stable entry route, with deployment failures informing revisions that convert operational experience into clarified procedures or constraints [Ling et al., 2026].Examples include SKILL.md, AGENTS.md, project instruction files, and organizational SOP templates.Source: §4.4 · p. 21

Distilled

• Distillation abstracts recurring successful structures from trajectories into transferable procedural units, while MemSkill shows that memory operations can themselves become learnable skills [Nottingham et al., 2024; Zhang et al., 2026a].This evidence supports induction from interaction traces rather than the broader claim that memory automatically becomes skill.Source: §4.4 · p. 21

Discovered

• Agents can discover skills through exploration, feedback, self-verification, and curriculum-driven task selection, producing executable libraries and improving reuse by separating abstract goals from implementations [Wang et al., 2023a; Yu et al., 2025].Voyager demonstrates this process in Minecraft, while PolySkill directs discovery toward generalization.Source: §4.4 · p. 21

Composed

• Composition builds higher-level skills by repeatedly coordinating and validating lower-level capabilities, producing hierarchical repertoires rather than flat collections [Wang et al., 2025c].Complex workflows such as report generation or code repair can become newly packaged reusable units.Source: §4.4 · p. 21

Overview

• Skill systems evolve procedural knowledge by writing, extracting, discovering, and recomposing experience into reusable externalized expertise.Memory provides evidence, evaluators determine what merits promotion, and protocolized execution surfaces whether candidate skills can be deployed.Source: §4.4 · p. 21

Overall boundary conditions

• These conditions show that skill effectiveness depends on continued alignment with tasks, environments, runtimes, and security constraints rather than on the artifact alone.Skills must therefore be embedded in a broader engineering framework, linking skill design to harness engineering.Source: §4.5 · pp. 21–22

Semantic alignment

• Externalized skills remain reliable only when their specifications, invocation decisions, tasks, tools, APIs, and environmental constraints are semantically aligned.Literal compliance can miss the task’s real objective; SkillProbe identifies semantic-behavioral inconsistency as a fundamental flaw in skill marketplaces [Guo et al., 2026], while tool-use research highlights deciding whether a capability should be called.Source: §4.5 · p. 22

Portability and staleness

• Skill portability is conditional: environmental changes and heterogeneity across frameworks, tools, and models can make skills misleading, obsolete, or inconsistent across settings.Some induced skills transfer across websites while incompatible ones require updates [Wang et al., 2025c], and SkillsBench finds substantial variation across domains and model-agent configurations [Li et al., 2026c].Source: §4.5 · p. 22

Unsafe composition

• Skill composition is security-sensitive because individually harmless artifacts can interact unsafely through instructions, scripts, dependencies, and connecting interfaces.Public skill ecosystems exhibit prompt injection, data exfiltration, privilege escalation, and supply-chain risks [Liu et al., 2026], while skill files can themselves serve as prompt-injection surfaces [Wang et al., 2026c].Source: §4.5 · p. 22

Context-dependent degradation

• Extended interaction can degrade skill execution when residual context, cached summaries, reinforced action patterns, or excessive procedural detail displace global task tracking.Adjacent work on multi-turn drift, long-horizon reliability, and long-context reasoning supports these as realistic conditions [Lee, 2026], making skill loading a context-allocation and execution-stability problem.Source: §4.5 · p. 22

Conditioning on memory

• Memory makes skill selection contextual by supplying task history, prior outcomes, user context, and environmental constraints for choosing and parameterizing skills.Without this conditioning loop, selection degenerates into keyword matching; with it, the same skill can be applied differently based on what the agent has learned.Source: §4.6 · p. 23

Binding through protocols

• Protocols ground selected skills in executable action through tool schemas, delegation contracts, file operations, and approval workflows that the harness resolves and governs.Skills specify what should be done, while protocols specify how actions are described, invoked, and governed.Source: §4.6 · p. 23

Runtime governance

• The harness governs production execution with permission checks, approval gates, audit logging, and rollback mechanisms beyond the skill artifact itself.Skills effective in sandboxed development may require additional production constraints enforced by the harness.Source: §4.6 · p. 23

Lifecycle feedback

• Execution traces, success rates, failures, and user corrections feed back into memory, enabling skill revision, deprecation, and promotion of new candidates.This lifecycle loop connects skill acquisition to runtime operation by using execution outcomes as evidence for future skills.Source: §4.6 · p. 23

4.7 Skill as Cognitive Artifact

• Skills reorganize procedural cognition by moving part of procedural knowledge from latent parameters into explicit representations that can be loaded, inspected, and followed.The interpretation applies cognitive-artifact theory to LLM agents rather than claiming that the theory was originally developed for them.Source: §4.7 · p. 23
• Externalized skills shift inference from reconstructing procedures from scratch toward recognizing applicable guidance, following it, and handling local exceptions [Li et al., 2026c, Xu and Yan, 2026b].The procedural structure becomes an external object that the model can operate on directly.Source: §4.7 · pp. 23–24
• Skills act as engineered complementary strategies by externalizing procedure definitions, constraints, and best practices while retaining contextual matching, interpretation, and exception handling for the model.This division addresses the instability of reproducing long, multi-step procedures while leveraging stronger performance on explicit guidance.Source: §4.7 · p. 24
• At system scale, skills move procedural expertise into inspectable, revisable, and composable structures, converting repeated workflow invention into runtime selection, loading, and composition.Their significance is therefore a reallocation of where know-how resides, not merely engineering convenience or the addition of prompts and tool wrappers.Source: §4.7 · p. 24

5 Externalized Interaction: Protocols

• Protocols externalize interaction grammar, lifecycle semantics, permissions, and discovery, turning external actions from fragile prompt-following into structured exchanges across system boundaries.They provide typed surfaces, state transitions, machine-readable constraints, and queryable metadata that models can fill and follow.Source: §5 · pp. 24–25

5.1 Why Protocols Matter

• Standardized protocols improve interoperability, security, auditability, and portability by making shared interaction grammars, execution constraints, and responsibility boundaries explicit.They support stable multi-agent collaboration, runtime validation, operator auditing, and reduced dependence on provider-specific interfaces [Yang et al., 2025a] [Ehtesham et al., 2025a].Source: §5.1 · pp. 25–26

5.2 Agent Protocol Survey

• The survey organizes contemporary protocols into agent-tool, agent-agent, agent-user, and domain-specific families that externalize different slices of interaction burden.The purpose is to show how protocols stabilize invocation, delegation, user-facing execution, and high-risk workflows rather than catalogue every emerging standard.Source: §5.2 · p. 26

5.2.1 Agent-Tool Protocols

• Agent-tool protocols such as MCP standardize capability discovery, schemas, invocation, and structured exchange, making tool access portable, inspectable, and extensible instead of adapter-specific.MCP commonly uses JSON-RPC 2.0, while ToolUniverse and related systems add specialized schemas and conventions [Anthropic, 2024] [Gao et al., 2025b,a].Source: §5.2.1 · p. 26

5.2.2 Agent-Agent Protocols

• Agent-agent protocols externalize delegation, capability discovery, identity, status, handoff, and partial-state exchange so coordination can scale beyond prompt conventions.A2A supports Agent Cards, task communication, negotiation, and streaming progress [Google, 2025a]; ACP favors lightweight REST/HTTP compatibility, whereas ANP targets decentralized, Internet-scale interoperability [Chang et al., 2025].Source: §5.2.2 · p. 27

5.2.3 Agent-User Protocols

• Agent-user protocols externalize interface composition and live execution state, making human-agent interaction more observable, reusable, and portable across hosts.A2UI provides constrained declarative UI descriptions, while AG-UI standardizes typed runtime events such as tool calls, results, completion, and errors [Google, 2025b].Source: §5.2.3 · p. 27

5.2.4 Other Protocols

• Domain protocols such as UCP and AP2 externalize workflow-specific governance for commerce and payments, encoding authorization, evidence, signatures, auditability, and responsibility tracking [Google, 2026] [Google Cloud, 2025b].Across protocol families, tool protocols govern invocation grammar, agent-agent protocols govern delegation, agent-user protocols govern presentation and streaming, and domain protocols govern specialized workflows [UCP Documentation, 2026].Source: §5.2.4 · pp. 27–28

5.3 Agent Protocol in Harness Engineering

• Harness protocols govern execution, persistence, delegation, and recovery by converting model communication into structured, validated, routed, and auditable runtime events.This replaces free-form guesses with governed interaction contracts suited to work spanning many steps, tools, agents, and approval boundaries.Source: §5.3 · p. 28

5.3.1 Intent Capture and Normalization

• Intent normalization maps free-text proposals into validated protocol objects, relocating fragile interaction semantics from latent inference to inspectable interfaces.The layer checks context and permission boundaries, rejecting or revising proposals that violate the contract and improving long-horizon reliability, governance, and handoffs.Source: §5.3.1 · p. 28

5.3.2 Capability Discovery and Tool Description

• Standardized capability metadata exposes available tools, schemas, and I/O structures, reducing context inflation while making permissions, versioning, and auditing governable.The agent reads a declared capability surface instead of guessing what can be called.Source: §5.3.2 · p. 28

5.3.3 Session and Lifecycle Management

• Lifecycle protocols preserve interaction continuity across turns, context windows, and phases through named states, transition rules, status events, checkpoints, and recovery.Protocol state covers identifiers, roles, pending actions, phase transitions, and allowed next moves; persistent checkpoints become memory, distinguishing interaction continuity from continuity across time.Source: §5.3.3 · p. 28

5.4 Protocol as Cognitive Artifact

• Under Norman’s cognitive-artifact framework, protocols transform interaction from open-ended inference into bounded tasks involving typed fields, declared transitions, and structured feedback.The model retains judgment about whether and when to act, but no longer reinvents interaction syntax and semantics at every step.Source: §5.4 · p. 29
• Protocol externalization removes interaction decisions from the model’s critical path, making correct behavior easier and incorrect behavior harder than unstructured communication.Unlike memory and skills, which externalize temporal state and procedural expertise, protocols externalize communication and coordination [Norman, 1993].Source: §5.4 · p. 29
• Kirsh’s complementary-strategy account assigns models judgment and intent while protocols provide format, validation, and lifecycle control.Neither side alone suffices; together they produce interaction that is flexible yet disciplined.Source: §5.4 · p. 29
• Protocols are cognitive artifacts that make memory and skills operational by providing inspectable, auditable, and recoverable interfaces for governed action.Memory needs governed read/write paths and skills need bindable interfaces; both depend on protocols to cross system boundaries.Source: §5.4 · p. 29

6.1 What is a Harness?

• A harness coordinates memory, skills, and protocols across perception, action, constraint, feedback, and revision, making agency emerge from the model’s coupling with its operational environment.It governs context access, tool invocation, state preservation, and feedback rather than merely adding peripheral capabilities.Source: §6.1 · p. 30

6.2.1 Agent Loop and Control Flow

• The agent loop interleaves perception, retrieval, planning, action, and observation, while step limits, recursion bounds, cost ceilings, and timeouts constrain execution paths.Systems vary from single-loop designs to hierarchical and multi-agent architectures with specialized tools and permission scopes.Source: §6.2.1 · p. 31

6.2.2 Sandboxing and Execution Isolation

• Sandboxing limits filesystem, network, resource, and action exposure, functioning as a cognitive boundary that removes irrelevant state and makes execution failures diagnosable and recoverable.Contemporary systems use dedicated task sandboxes or graduated permission modes for different trust levels.Source: §6.2.2 · pp. 31–32

6.2.3 Human Oversight and Approval Gates

• Human oversight makes autonomy configurable through pre-execution approval, post-execution review, escalation triggers, and lifecycle hooks that vary by task, tool, and organizational policy.These gates can require confirmation for consequential actions or intervene when sensitive, irreversible, or low-confidence operations occur.Source: §6.2.3 · p. 32

6.2.4 Observability and Structured Feedback

• Observability records model calls, tool use, memory operations, decision branches, traces, and aggregate metrics, enabling debugging, auditing, and feedback-driven revision of memories, skills, and protocol paths.Repeated failures can trigger memory writes or skill revision, while latency changes can redirect protocol execution.Source: §6.2.4 · p. 32

6.2.5 Configuration, Permissions, and Policy Encoding

• Configuration externalizes governance by enforcing versionable, auditable policies across user, project, and organization scopes without changing the base model or loaded skill artifacts.These declarative rules specify tool access, filesystem paths, approval requirements, compliance constraints, cost ceilings, and data-handling rules.Source: §6.2.5 · p. 32

6.2.6 Context Budget Management

• Context management dynamically allocates the finite window among memory, skills, protocols, tools, history, and reasoning through summarization, priority eviction, and staged loading.The optimal allocation changes with execution phase, so harness coordination is a goal- and constraint-sensitive resource-allocation problem.Source: §6.2.6 · p. 33

6.3 Harness in Practice: Contemporary Agent Systems

• OpenAI Codex [OpenAI, 2025a] and Anthropic Claude Code [Anthropic, 2026] converge on similar harness structures, suggesting these are structural requirements of externalized agency.The cited passages describe explicit loops and controls, execution isolation, configurable approval gates, structured execution traces, and scoped configuration and governance.Source: §6.3 · pp. 33–34

7.1 Module Interaction Map

• Protocol validation provides a safety boundary independent of skill correctness, preventing forbidden operations or malformed calls even when procedural guidance is sound.This is especially important when sensitive data access, unconstrained communication, and unverified execution combine into the “Lethal Trifecta.”Source: §7.1 · p. 36
• Protocol standardization expands the surface for reusable skills, while execution recording keeps skills self-correcting and memory-informed routing selects among local, tool, and delegated actions.Stable interfaces make domain procedures portable, whereas durable execution histories provide evidence for revising, splitting, or constraining skills.Source: §7.1 · pp. 36–37
• Harness-mediated couplings make externalization self-reinforcing but error-prone: memory distills skills, skills generate traces, and protocols validate actions and write results back.Poisoned memories can cascade into flawed skills and contaminated traces, while context budgets and mismatched timescales require explicit coordination.Source: Figure 8 · p. 35, §7.1 · pp. 36–37

7.2 The LLM Input/Output Perspective

• At the model boundary, memory supplies contextual input, skills provide instructional input, and protocols constrain outputs into governed action schemas.This decomposition separates retrieval, procedural-guidance, and action-schema failures, allowing the harness to debug and revise each layer independently.Source: §7.2 · pp. 37–38

7.3 Parametric vs. Externalized: The Trade-off Space

• Externalize fast-changing, reusable, governable capabilities, but retain stable, generic competencies parametrically when externalization would add latency, context burden, or maintenance overhead.The optimal boundary depends on update frequency, portability, auditability, execution cost, and task characteristics, and it shifts as models and infrastructure mature.Source: §7.3 · pp. 38–39
• Externalized artifacts offer inspectable interfaces, approval, rollback, provenance, and deterministic enforcement, making outward architectural boundaries increasingly important for high-stakes actions.Parametric alignment shapes behavior probabilistically, whereas externalized constraints enforce policies at the interface level.Source: §7.3 · pp. 38–39

8.1 The Expanding Frontier

• The externalization frontier shifts bidirectionally: model advances can make infrastructure redundant, while richer harnesses impose new demands and expose planning, evaluation, orchestration, and multimodal work for externalization.Plans may become persistent harness objects, evaluation may become runtime quality infrastructure, and multimodal systems require redesigned skills, memory indexing, and protocol schemas.Source: §8.1 · pp. 39–40

8.2 From Digital Agents to Embodied Externalization

• Embodied agents recapitulate digital externalization by separating deliberative planning from low-latency execution through a high-level agent, callable VLA skills, and structured communication protocols.This decomposition addresses monolithic systems’ planning, diagnosis, inference-speed, and capacity limits, while physical irreversibility, tight latency budgets, noisy perception, and sim-to-real gaps remain constraints.Source: §8.2 · p. 41

8.3 Toward Self-Evolving Harnesses

• Self-evolving harnesses could adapt module policies, restructure execution pipelines, and expand or contract their externalized scope in response to observed failures and changing tasks.Reinforcement learning, program synthesis, evolutionary search, and imitation learning target policy, program, structure, and prior-experience adaptation, but unguided drift can create new failures.Source: §8.3 · pp. 41–42

8.4 Costs, Risks, and Governance

• Externalization accumulates cognitive overhead and security risks, requiring utility-positive design and governance through minimal sufficiency, lazy loading, budget-aware routing, review gates, provenance, rollback, and regression testing.Over-retrieval, verbose skills, tool sprawl, memory poisoning, malicious skill injection, and protocol spoofing can degrade performance or trigger unauthorized actions, especially under self-evolution.Source: §8.4 · pp. 42–43

8.5 From Private Scaffolding to Shared Infrastructure

• As externalized artifacts become shared across agents, memory, skills, and protocols support transactive knowledge, reusable expertise, interoperable coordination, differentiated roles, and collective learning.At ecosystem scale, shared infrastructure also creates institutional governance problems involving drift, artifact quality, standardization, version control, permissions, provenance, and rollback.Source: §8.5 · p. 43

8.6 Measuring Externalization

• Evaluation must measure externalization directly through transferability, maintainability, recovery robustness, context efficiency, governance quality, ablations, cross-model transfer, and long-horizon reliability rather than task completion alone.Current benchmarks under-attribute gains from memory retrieval, skill loading, and execution governance to infrastructure; AHB also extends evaluation toward humanized observable behavior at the interface boundary Zhu et al. [2026].Source: §8.6 · pp. 43–44

8 Future Discussion

• Together, these directions frame externalization as an ongoing process whose mechanisms, costs, boundaries, ecosystem scope, and quality criteria co-evolve with models and the systems around them.The synthesis covers multimodal and embodied extensions, self-evolving harnesses, accumulating overhead and security risks, shared infrastructure, and the limits of model-centric benchmarks.Source: §8.6 · p. 44

• Externalization relocates cognitive burdens into infrastructure: memory preserves state across time, skills provide procedural expertise, protocols structure interaction, and the harness coordinates these layers.Together, these components form a working runtime for reliable agency.Source: §9 · p. 44
• The shift from weights to context to harness changes where agent capability is organized, making some burdens more reliable when they are persistent, inspectable, reusable, and governable.Other burdens remain well handled parametrically.Source: §9 · p. 44
• Externalization transforms representations: memory converts recall into retrieval, skills convert improvisation into guided composition, and protocols convert ad hoc coordination into structured exchange.This changes the task assigned to the model rather than merely adding surrounding components.Source: §9 · p. 44
• The resulting agenda concerns capability partitioning, evaluation of externalized systems, governance of shared artifacts, and the co-evolution of models with external infrastructure.Better agents are therefore better organized cognitive systems, not merely better reasoners.Source: §9 · p. 44