---
title: "What a harness actually does"
url: "https://kyberbot.com/blog/what-a-harness-actually-does"
description: "Everyone is building planners. The interesting layer is the one that tells a planner no — below intent, above the drivers, and unable to be argued with."
---

# What a harness actually does

August 30, 2026·3 min read·Editorial team

A rounded safety module with a mechanical limit switch, wired between a motor and a robot joint

Everyone is building planners. Almost nobody is building the layer that tells a planner no. A harness is that layer: it does not decide what the robot should do, it decides what the robot is permitted to attempt — and the difference between those two sentences is most of what separates a demo from a machine you would leave running near people.

## Where it sits

Above the drivers, below the planner. That position is the whole design.

**Above the drivers** means it is portable. Limits expressed in terms of reach, force, speed and zones survive a change of robot vendor, because they describe the task rather than the hardware. Reimplementing the envelope inside each manufacturer’s controller is how organisations end up with four different definitions of the same rule.

**Below the planner** means it cannot be reasoned with. A planner — increasingly, a model — proposes a trajectory. The harness evaluates it against the envelope and either passes it through or refuses. There is no prompt to phrase more persuasively, because the harness never reads the reasoning, only the motion.

## What it is made of

A useful harness expresses five things, and all of them are data rather than code.

**Geometry.** Where the machine may be, and where it may reach: zones, keep-outs, height limits, the corridor a mobile base may use at a given time of day.

**Dynamics.** Speed and force ceilings, tied to context. Full speed in an empty aisle, reduced speed when a person is detected within a distance, force limits that make the difference between a bump and an injury.

**Time.** Night shift is not day shift. A machine permitted to move pallets at 02:00 in an empty warehouse should not have the same envelope at 14:00.

**Task.** What operations are permitted at all, and where. A robot allowed to lift may not be allowed to lift _that_, in _that_ aisle, while _that_ is happening.

**Escalation.** What to do at the boundary: refuse, slow, stop, hand back to a human. The answer is different for each class of violation, and choosing it is a safety decision rather than an implementation detail.

## The properties that make it trustworthy

**Declarative.** The envelope is data you can read, review, test and diff. “Why is the robot allowed to do that” should be answerable by reading a file, not by tracing control flow.

**Versioned.** Changing what a machine may do is a reviewable change with an author and a date. Most incident reports in automation eventually reach a sentence like “somebody changed a parameter”; versioning is how that sentence gets a name attached to it.

**Testable.** You can replay a recorded shift against a proposed envelope and see what would have been refused. That turns a safety change from an argument into an experiment.

**Fail-closed.** A policy that cannot be parsed stops the machine. This is the property most often missed in software written by people used to web services, where failing open is usually the kind thing to do. On a factory floor it is not.

## What a harness is not

It is not a substitute for functional safety. Emergency stops, safety-rated controllers, light curtains and the standards governing them exist because software running on a general purpose computer cannot make the guarantees those systems make. A harness lives above them and should make their job easier — reducing how often the certified layer has to intervene, never pretending to replace it.

It is also not a planner, a perception stack or a fleet manager. Those are hard problems with good existing answers. The harness is the thin, boring, load-bearing layer between them and the actuators, and it is boring on purpose: the part of a robot that says no should be the part that is easiest to read.

## Why this is the product

A planner that is right 99% of the time is an impressive planner and an unacceptable robot. Everything interesting in physical autonomy happens in the last percent, and the last percent is not a modelling problem — it is a question of what the machine is structurally incapable of attempting.

That is the harness. Everything else is what the robot does inside it.

-   harness
-   work envelope
-   safety
-   architecture

## Keep reading

-   [What it means for an assistant to know you best](https://kyberbot.com/blog/an-assistant-that-knows-you)
-   [How an assistant hands work to a swarm](https://kyberbot.com/blog/how-an-assistant-hands-work-to-a-swarm)