Answers, then stops.

Ask a well-run front desk a question and notice what does not happen. Nobody recites the catalog. Nobody guesses a date to make you feel better. You get the answer, the page it came from and one thing to do next, and then the person stops talking and lets you decide. The pause at the end is not rudeness. It is the part of the service that leaves room for you.

AI assistants find that pause hard. A language model is built to continue: give it a question and it produces the most plausible next word, and the next, for as long as it is allowed. Fluency is its native gift, and fluency does not know when it has run out of evidence. Left alone, a model fills silence with hedges, a second offer, a restated question, a cheerful guess.

So the stopping has to come from somewhere else. It comes from the system around the model, which the industry has started calling a harness. This library uses Deyaf's definition:

An Agentic Harness is everything around the AI model: what the assistant knows, what it remembers, where it meets customers, what it may do, and how your team teaches it.

Deyaf's definition

Restraint lives in that "everything". It is written into the rules the model reads, the records it is allowed to quote, the verbs it is allowed to use and the people who review what it learns. None of it is visible in a single reply, and all of it decides where that reply ends.

Eve is a working example. She is Feniex's assistant, the warm and composed public face that helps people choose suitable equipment, make a buying decision or get support for what they already own. Eve runs on the Agentic Harness Deyaf packages: her knowledge, memory, doors, rules and learning loop. Her manner is a specification, not a mood. She answers first, gives one useful next step, then stops; her replies are usually two or three sentences. She asks for one missing detail at a time and accepts corrections. She respects a customer's budget and recommends the simpler option when it is enough. She acknowledges frustration once, and she never tacks a sales pitch onto a support answer.

None of that is decoration. Anthropic's engineers, writing about the agents that hold up in production, recommend the simplest solution that does the job, adding complexity only when it demonstrably helps. The same discipline applies inside a single reply. Every extra sentence is a new claim the customer has to trust, and every claim needs somewhere to come from.

Deyaf ↗Meet Eve, and how she talksDeyaf

The first rule of Eve's evidence contract is short enough to fit on a card. Before any exact product, compatibility, warranty, price or software claim, she checks the applicable record. Her operating rules give the reason in one line: a convincing product name is not evidence.

That line exists because names persuade. Two model names that differ by a letter look like siblings, and a model that has read a thousand catalogs will happily infer that the accessory for one fits the other. Sometimes it does. The harness does not let "sometimes" reach a customer. Eve's answers draw on an exact reference layer (versioned catalog, manual, software, fitment and policy records, with verified resource links) and on a taught library of reviewed lessons found by meaning. An exact claim is either backed by one of those, or it is not made.

Deyaf tells the same story as four steps: listen, look it up, check the rules, reply. The model is one step of four. The other three are plumbing a customer never sees, and they are where most of the honesty is decided.

Courts have already priced the alternative. In February 2024 a British Columbia tribunal decided Moffatt v. Air Canada. The airline's website chatbot had told a grieving customer he could apply for a bereavement fare after he travelled; the airline's own policy page said otherwise. Air Canada argued, in effect, that the chatbot was a separate thing responsible for its own words. The tribunal disagreed and ordered the airline to pay C$812.02. The chatbot was not malicious. It simply answered from somewhere other than the current policy.

Checking the record does not mean handing the model everything. Chroma's study of "context rot" tested 18 models and found that every one degraded as its input grew; on one long-memory benchmark, a focused prompt of about 300 tokens beat the full version of about 113,000 tokens vendor-reported. Anthropic's guide to context engineering makes the same point from the builder's side: good context is the smallest set of high-signal tokens that makes the right outcome likely. The lookup is a narrowing, not a flood. The right record, and only the right record, goes in front of the model.

Deyaf ↗The model is one step of fourDeyaf

The second rule is harder, because it asks the system to say less than it could. When sources conflict or a specification is missing, Eve explains the exact uncertainty and offers a useful clarification or a bounded hand-off. A failed lookup means "I couldn't check", not "it doesn't exist". An absence of evidence that two things work together means "unconfirmed", not "incompatible".

The distinction sounds pedantic until it goes wrong. A search that times out and a search that finds nothing can produce the same empty result, and a model that reads both as "no such product" will tell a customer that something they own was never made. "Unknown stays unknown" is the rule that keeps a system failure from turning into a false fact.

The third rule decides which record wins. Authority and applicability outrank recency. The current approved policy governs current purchases; an older manual can explain older equipment, but it cannot set today's options or one owner's eligibility. The newest document in the pile is not automatically the right one, and a page that was never approved does not count at all.

Public failures show what happens when a system forgets this. In April 2025 the AI support agent for the code editor Cursor told users that being logged out when they switched machines was the result of a new policy. There was no such policy; the model had invented a plausible reason, and customers cancelled over it. A year earlier, The Markup found that New York City's MyCity chatbot told business owners they could take a cut of workers' tips and turn away tenants with housing vouchers, both contrary to city law. In each case the system preferred a confident sentence to an honest gap.

Deyaf's harness principles put the lesson bluntly: fake grounding is worse than none. When a source is not connected, the honest reply says so ("that isn't connected yet") and then offers what is known. An invented number feels helpful for one conversation and costs trust for many.

Deyaf ↗What happens when she doesn't knowDeyaf

Words about actions are claims too, and they are the easiest ones to inflate. "I've sent it" sounds better than "I've saved it for the team", so a model eager to please will reach for it. Eve's harness gives her a small, strict vocabulary instead: saved, drafted, sent, uncertain, acknowledged, resolved. Each word names a state that a result has to prove. Saving is not delivery. Delivery is not resolution. Drafting is not sending.

The hand-off is where this matters most. When Eve cannot answer a web, phone, text or email question, it becomes a durable unanswered item, and when contact details are available a support ticket is filed for the team. She says a matter is "with the support team" only when the ticketing system confirms it accepted the ticket. An uncertain submission is not retried blindly, because the other side may already have it; a duplicate ticket is its own small harm.

For this to work, the tools have to tell the truth first. Anthropic's guide to writing tools for agents asks for responses that carry meaningful, high-signal context and for errors that say what actually went wrong instead of an opaque code. A harness can only make an assistant's words as honest as the results underneath them. If the tool says "accepted", she may say "with the team". If it says nothing, she says what she knows.

The discipline shows in what Feniex publishes about hand-offs. From September 16 to 23, 2026, zero were lost: every one sent reached the team. As of September 24, 2026 · Feniex's internal Eve 3.0 report · machine-judged and provisional. The hand-off figure on Eve's report card ↗

The same design runs through her other doors. Texts go back to the sender, email replies stay in their thread, and the model never chooses a destination. It can only describe what the system did.

Deyaf ↗Answering is not actingDeyaf

Restraint also has manners. When a question is missing something, Eve asks for one detail, the one that unlocks the record, and waits. A three-part question feels efficient to the person asking it and tiring to the person answering. Most people answer the part they understand, skip the rest, and the conversation loops back on itself.

The same care covers what she does not offer. A price is quoted only as published and with its type. She never infers discounts, stock or delivery dates, never manufactures urgency, and claims no authority to approve returns, change accounts, place orders or decide sensitive matters. When someone describes a hazard, safety comes before troubleshooting: stop, step away, get help, and no walkthrough into opening anything up.

These limits are not timidity. In December 2023 a car dealership's website chatbot was talked into "agreeing" to sell a new SUV for one dollar and calling it a binding offer. The lesson the industry took from that screenshot was structural: a model should never make a commitment that code has not approved. Deyaf publishes a three-level ladder (answer only, prepare for approval, run an approved task), set per workflow and per channel, and every assistant starts on the first level. There is no single switch that lets her do everything.

Deyaf ↗What the assistant can and cannot doDeyaf

Everything in this essay eventually has to fit inside a small box in the corner of a web page. The website chat box is the most visible door a harness has, and the smallest, and it is where restraint is easiest to lose: a box that can speak is tempted to speak first.

So the manners begin before the first word. A restrained box waits to be opened; it does not pop up over the page someone came to read. When it does speak, it says what it is. Eve introduces herself as Feniex's intelligence and never pretends to be a person. Her reply streams, so the first words arrive quickly, and the page the visitor is on travels with the question, so she does not have to ask what they are looking at. Then the shape from the first chapter: the answer, one useful next step, and a stop, usually in two or three sentences. The box goes quiet and leaves the next move to the visitor.

The last courtesy is an honest path to a person. When she cannot answer, the question becomes a durable unanswered item; with contact details a ticket is filed, and she says the matter is with the support team only once that ticket is confirmed accepted. The Box in the Corner draws that hand-off panel by panel, beside the stream and the product tile, and From Script to Source tells how the box got here.

On the phone the pause means something else. Silence on a call sounds like a dropped line, so there the harness fills it with short cues, "One moment" after about a second and a half. Restraint on a call is not quiet; it is brief. Nobody Has to Hold follows that line through a day.

Deyaf ↗Watch Eve answer on five doorsDeyaf

There are two broad ways to make an assistant better over time. One lets the agent improve itself: it writes its own skills, curates its own memory and grows around the person using it. The other keeps a human in the loop for everything that becomes public knowledge. Eve is built the second way, on purpose. She is a specialist front desk, and a stranger's first five minutes are no place for a self-taught fact.

In practice this looks like a quiet queue. Every question she could not answer lands as an unanswered item. A person writes the reusable answer once; it is reviewed; the lesson and its receipt are committed together; and the next customer who asks gets it. Answering this customer and creating a reusable lesson are separate operations. Raw conversations never become public knowledge automatically, and contact information is stored apart from published knowledge and never copied into it.

At a larger scale, support tickets and calls are folded into a redacted, de-duplicated question book. Eve is measured on a frozen test set without making live changes; only explicitly approved lessons are published; then she is measured again. Deyaf lists the lesson sources as support tickets (monthly), call recordings (every 60 days) and the teach queue (daily). It is a supervised knowledge-improvement loop: not fine-tuning, and not training on every raw conversation.

The engineering community has been arriving at the same instinct from another direction. Mitchell Hashimoto, describing how he adopted coding agents, calls it engineering the harness: when an agent makes a mistake, change its instructions or its tools so that it does not make that mistake again. The team behind the Manus agent argues for keeping failed steps in the context instead of scrubbing them, because erasing a failure erases the evidence a model needs to adapt. Eve's version is slower and more supervised. A miss is not hidden; it is queued, answered once by a person, and measured before it is taught.

The difference matters most on the days nobody is watching. A self-improving generalist can drift toward whatever its last hundred conversations rewarded. A taught desk can only say what a person has written or approved, and its answers cite the approved source they came from. Humans author public knowledge; the harness measures and proves it.

Deyaf ↗The loop that makes her betterDeyaf

Restraint is only a virtue if it is measured, because a system that refuses everything is never technically wrong. Eve's report card counts restraint as a result, not as a failure to answer. On 100 fixed test questions graded on September 23, 2026, 86% were handled well, and 10% contained a material error. Inside the 86: 65 fully answered, 17 handled safely within limits, and 4 where she asked the right question back. Another 4 were useful but partial. There were no critical errors.

The trend is reported honestly too: 88% on September 17, 90% on September 21, 86% on September 23. That is not steady improvement, and nobody presents it as such. By type, reworded questions scored 100% and manual questions 95%, while past trouble spots scored 40%. That last group is kept in the test on purpose, so the weakest ground stays in view. Anthropic's guide to agent evaluations recommends building a first test set from a few dozen real failures; keeping the hard cases in is the same idea, applied to a front desk.

The numbers are Feniex's own, machine-judged and provisional, and they are published with their weak spots showing. That is the last form of restraint in the harness: claiming no more about the system than the system has shown.

Deyaf ↗Eve's report card, weak spots includedDeyaf