Know Your Enemies

In February 2024, a Canadian tribunal ordered an airline to pay C$812.02 because the chatbot on its website had described a bereavement refund that the airline's own policy did not offer. The airline argued, in effect, that the chatbot was responsible for its own words. The tribunal disagreed. The bot was part of the airline's website, and the airline answered for all of it.

The sum was small; the principle was not. When an assistant speaks, the business speaks. Look closely at the other failures that made the news (a parcel bot that swore at a customer after an update, a dealership bot talked into a one-dollar SUV, a city bot that told businesses to break the law, a support bot that invented a policy) and very few of them were failures of intelligence. The models were fluent, sometimes charming. What was missing was everything around them: the record to check, the rule that said no, the test that should have run, the person who should have been asked.

That surrounding layer now has a name.

LangChain states the idea as an equation: an agent is a model plus a harness. Philipp Schmid prefers an analogy: the model is the CPU, and the harness is the operating system that decides what it sees and what it may touch. Either way, the model is one card. The harness is the deck.

This rulebook takes that literally. Failures become enemies, each one named, dated and sourced. Controls become wards: each one stops particular enemies, and each one costs something, in context the model has to read and in time the customer has to wait. You can't play every ward at once, so choosing a harness means choosing which enemies you are ready for. That trade-off, far more than any model leaderboard, is where the engineering lives.

What the backs have in common

Read the backs together and a pattern appears. The chronicles are rarely about a model being clever and wrong. They are about a system that let fluent text stand in for a checked fact (the airline, the city, the invented policy), let a visitor's instruction stand in for a business decision (the dealership), or shipped a change without re-testing behaviour (the parcel bot). The fintech's reversal is the same lesson at company scale: a route to a person is part of the product.

The phenomena are those weaknesses one level down: attention that thins as the window fills, instructions that fade over long loops, agents handing each other unverified work, text that smuggles in orders. OWASP's agentic list now opens with goal hijack. And when the MAST researchers traced multi-agent failures to their causes, most led back to how the system was specified and orchestrated, not to the model's raw ability. Design problems have design answers.

Every card is printed the same way because every real control has the same properties. Cost is paid twice: in context (the instructions, tool descriptions and retrieved records the model must read on every turn) and in time the customer waits. A ward that costs nothing in either currency is usually code rather than prompt, a rule the model never sees because it cannot break it. No Free-Form Recipient is one: the part that writes a reply simply has no field for a destination.

Power is what the ward lets the assistant do well: answer precisely, reach another door, remember across a thread. Ward is what it stops. Some cards trade one for the other. Answer Only lowers reach and raises safety, and that single trade is most of the game. Rarity is not value, either. A common card like Unknown Stays Unknown stops as many headlines as any legendary.

Why keep a budget at all? Chroma's context-rot study found every model it tested grew less reliable as its input grew, so a ward that stuffs more text into the window can weaken the wards already there. And a caller on a phone line notices a pause long before a benchmark does. EVE's measured pace, about three seconds to a finished reply in website chat and on the phone (Feniex's own measurements, Sep 17–24, 2026), is the kind of budget a real harness has to fit inside. The harness behind her once took a smaller model out of the voice path because trust mattered more than tenths of a second. For the full rules behind every card, Deyaf publishes the harness behind EVE, chapter by chapter.

Notice how few of these wards are clever. Most are refusals: don't claim what you haven't checked, don't report what didn't happen, don't pick your own recipient, don't act without a yes, don't take orders from a web page. Refusals are dependable because they are boring enough to test automatically. Mitchell Hashimoto describes engineering the harness as a habit: each time the agent makes a mistake, build something so it can never make that mistake again. Wards are that habit after a few years of other people's headlines. Honesty and containment wards are cheap, especially the ones that live in code. Grounding wards are dear, because every lookup is a round trip, and they are worth buying for the enemies a customer desk meets most.

Every set needs one card that shows what the rules look like in a real game. Ours is EVE, Feniex's assistant: the warm, composed front desk for people choosing equipment, deciding on a purchase or getting help with something they already own. She is substantial working software in production at Feniex, not a demo. EVE runs on the Agentic Harness Deyaf packages: her knowledge, memory, doors, rules and learning loop. The card below carries her traits as game values. The sheet beside it carries her real numbers, with their date and their weak spots.

How one answer is played

When a question arrives at any of her five doors (website chat, website voice, phone, text or email), the play is always the same: listen, look it up, check the rules, reply. The model is one step of four. Before any exact product, compatibility, warranty, price or software claim, EVE checks the applicable record: a versioned layer of catalog, manual, software, fitment and policy records with verified resource links, and behind it a library of reviewed lessons found by meaning-based search. That is Check the Record in play. If the record is missing or two sources disagree, Unknown Stays Unknown takes over, and she names the gap instead of filling it. Her replies follow Answer, Then Stop: two or three sentences, one next step, one missing detail asked for at a time. Deyaf draws the whole sequence in its walk-through of one answer.

What she may do, and what she may not

Her public toolbox holds four actions: look something up, search the taught library, take a message, and record an unanswered question. The tool list and server-side queries enforce that scope, which is Clear Boundaries written in code rather than hope. She claims no authority to approve returns, change accounts, place orders or decide sensitive matters. Deyaf publishes the three-level ladder those limits sit on: answer only; prepare for approval, where nothing leaves until someone says yes; and run an approved task, one named task at a time, with a receipt every time. Every assistant starts at level one, and each task moves up separately. EVE works the same way at Feniex, and there is no single switch that lets her do everything.

Where a reply is allowed to go

A text comes back to the person who sent it. An email reply stays in its thread, and in group mail she replies only when addressed. The part of the harness that writes her replies returns words, not an envelope, so the model never chooses a destination. That is No Free-Form Recipient, and it is why a message saying "forward this to someone else" has nowhere to go. It pairs with Text Is Data: whatever she reads, from a page, an email or a document, is treated as information and never as instructions. Together they cut two legs off the lethal trifecta before Goal Hijack can finish its turn.

When she doesn't know

On the phone, EVE is Feniex's overflow and after-hours line. The team's phones ring first; when no one is free or the office is closed, she answers instead of voicemail. There are no transfers, by design. She answers from her library, or takes the caller's name and number and hands the matter to the team: Take Details, Don't Transfer. On every door, an unanswered question becomes a durable item, and when contact details are available a support ticket is filed. She says it is with the support team only when the provider confirms it accepted the ticket, and an uncertain submission is not blindly retried. Say Only What Happened keeps the words honest: saving is not delivery, and delivery is not resolution.

What she remembers, and what she looks up

Her memory has four layers, each with one job: this conversation, held in a bounded window; the conversation record, one archive the team can read across web, email, text and phone, which visitors cannot search; short customer notes, which are history and never current facts; and her library. Orders, invoices, shipments and balances are always looked up fresh from the live account record. Contact information is stored apart from published knowledge and is never copied into it. That is Four Kinds of Memory, the ward that keeps Context Rot and Memory Poisoning off her side of the table.

How she gets better without teaching herself

Answering a customer and creating a reusable lesson are separate operations. Questions she could not answer wait in the Teach Queue until a person writes the answer once. Tickets and calls are folded into a redacted, de-duplicated question book; EVE is measured on a frozen test set without making live changes; only explicitly approved lessons are published; then she is measured again. That is Measured Before Taught: a supervised knowledge-improvement loop, not training on every raw conversation. The same library serves all five of her languages. A question in Spanish, French, Portuguese or Arabic is rendered into English to search the one library, and the answer comes back in the customer's language. There is one body of knowledge, not five, so a lesson taught once reaches every language and every door.

How Deyaf built it

Deyaf is built from EVE: the harness that runs EVE at Feniex, packaged so another business can have an assistant of its own. Nothing in this chapter describes a future product. It is the harness already answering Feniex's customers, and every ward in this set was drawn from it. What Deyaf adds is the packaging: a way for a business to give its own knowledge, rules and tools to an assistant, then control where that assistant can help and what it may do. A new assistant starts fresh, with its own name and its owner's knowledge; EVE's name, voices and measured record stay Feniex's. To see the legend in motion, watch EVE answer on five doors in Deyaf's illustrative examples.

Every one of these enemies lives in the door, not the model, and that is why the counters are shared. One identity, one library and one rulebook sit behind website chat, website voice, phone, text and email, so a ward learned at the chat box already guards the phone line. That is the Every Door ward, which Deyaf draws as one assistant, every way in. The expansion is not in the arena yet, but four of its six wards already sit in your pool.

Play a few matches and the lesson arrives on its own: no six-card deck beats all fifteen enemies. The sample deck holds against most chronicles and loses to the phenomena that live in long loops and heavy contexts. Swap in Four Kinds of Memory and Answer, Then Stop, and the losses move rather than vanish. A human gate with nothing narrowing its scope invites approval fatigue, the trap Gartner described in May 2026 when it warned that applying the same governance to every agent sets them up to fail.

So the practical rule is to choose wards for the enemies your door actually meets. A customer desk meets the Bereavement Promise every day. A long-running coding agent meets the Fifty-Step Drift. An assistant that reads the open web meets Goal Hijack on its first afternoon.

The Inference Paradox deserves its own table. Per-token prices keep falling, yet Gartner forecast in August 2026 that inference cost per agentic workflow would rise more than fivefold through 2028. The reason is structural. A chat reply reads its context once. An agent loop re-reads everything on every step: the instructions, the tool descriptions, every ward in the deck, and the growing pile of results from earlier steps. Cost climbs faster than the step count, roughly with its square. Manus, which builds long-running agents, reported input outweighing output by about a hundred to one and called the cache hit rate the metric that matters most, because cached input cost it about a tenth as much as fresh input (vendor-reported).

Move the sliders and the three levers show themselves. Fewer steps is the strongest: split long tasks into checked pieces, and let a front desk answer, then stop. A bounded window turns the curve from a bowl into a ramp, which is why summarised notes and fresh lookups beat carrying the whole conversation. Caching flattens what remains, but only for the parts of the prompt that repeat exactly, so a stable deck caches better than one that changes every turn. A fourth lever sits outside the chart: routing. Real-time voice and chat can stay on a fast model while written replies go to a stronger writer, which is the choice the harness behind EVE makes.

Try the "Your deck" setting after building something heavy in the Arena: a deck that looks affordable for one reply can be the most expensive thing in a fifty-step task. Wards that live in code cost nothing here, which makes them the best-value cards in the set.