RD. Contact

AI Integration·Insights

"ASD just told you what to own. It isn't the model."

In September the Australian Signals Directorate published a piece of guidance called Agentic AI Harnesses: The layer above the model. Buried in it is a sentence that should reset how every Australian SME thinks about its AI stack, "no harness is inherently secure." But the line that matters more is the one right after it, where ASD says the harness is the durable enterprise capability and the model is a pluggable commodity that will be swapped over time. The regulator just told you which part of your AI is an asset and which part is a rental.

In September the Australian Signals Directorate published a piece of guidance called Agentic AI Harnesses: The layer above the model. Buried in it is a sentence that should reset how every Australian SME thinks about its AI stack:

"No harness is inherently secure."

But the line that matters more comes right after it. ASD says the harness, the software layer around the model, "represents the enduring enterprise capability, governance architecture, and intellectual property." The model itself is "a pluggable commodity component that will be swapped over time."

The regulator just named which part of your AI is an asset and which part is a rental.

The body, not the brain

The harness is everything that isn't the model. It's what supplies context and memory, executes the tools and API calls, enforces permissions, and runs the control loop. The model is the brain. The harness is the body.

ASD names eleven components you're expected to own: the user interface, the prompt and policy layer, the context manager, the model interface, the tool registry, the permission system, the execution environment, the connector layer (your RAG and MCP wiring), the memory and session store, audit and observability, and the update and supply-chain path.

I've asked a handful of Melbourne business owners to name three of those eleven. Nobody has yet. That's not a knock on them. The word didn't exist in this context a few weeks ago. It's just the gap.

Why this is a board question now, not a tech one

SAP and Oxford Economics surveyed 2,600 leaders across 13 countries. The Australian cut is ugly. Forty-nine percent of Australian organisations say AI agents have already taken incorrect actions in a pilot or in production. Forty-three percent have no human-in-the-loop process for agentic workflows at all. Forty-two percent are deploying agents faster than they can standardise and govern them.

Then there's the cost side, and this is the part people skip. ASD specifically warns about "denial-of-wallet", an agent loop that runs away with your API budget. That isn't theoretical. A consultant told Axios about a client who burned half a billion dollars in a single month after failing to set usage limits. Uber reportedly ran through its entire 2026 AI coding budget in four months.

Put a per-token meter on an autonomous loop with no circuit breaker and you've built a machine that spends money while you sleep.

The four questions worth asking this week

The National AI Centre released its agentic AI risk findings at the end of September. Four questions came out of it, and I'd put them to any business running an agent:

What can it access? What can it do? What authority does it have? Who's still accountable?

Ask those in order and you'll usually find the paid work inside fifteen minutes. Most owners answer the first one vaguely and stall on the second.

The other thing NAC and ASD both say is worth repeating, because it's the most credible anti-hype line in the country right now: consider whether a simpler workflow is sufficient. Don't agent what a script can do. I've made that mistake myself. I built an agent for something a scheduled job would have handled. It's an expensive way to look clever.

What it means for a Melbourne SME

Ninety-nine percent of Australian organisations now report some form of sovereign AI requirement. Seventy-six percent cite data residency constraints that limit which models they can use.

So the model is the one part of your stack you can't control. Vendors swap it, re-price it, deprecate it. And under an agreement like the Australia–US CLOUD Act arrangement, a genuinely Sydney-hosted model from a US-jurisdiction provider can still be compelled. Residency isn't the same thing as sovereignty. The harness is the part you can control, and it's the part ASD says you own.

That's the local-first argument, and I didn't have to make it. The regulator made it for me.

What we're doing about it

We're running a fixed-fee Harness & Reach Audit. Two to three weeks, A$15,000 to A$40,000. What you get: a scored inventory of your AI systems against ASD's eleven components; an agent-reach probe that asks what an autonomous agent can touch that a human never would; a cost-runaway check on your token and API controls; a small, repeatable eval harness for your own agents; and a gap assessment against APRA CPS 234, the Essential Eight and Privacy Act APP 11.

The whole audit runs without your data leaving the premises, which is the only way an audit like this should work.

Worth saying plainly: the assurance shops in Australia will sell you a register and a policy. The Big Four will charge you north of $300,000. Nobody in the governance lane is marketing against the ASD harness guidance by name yet, and I don't think that window stays open past a month.

If you've got agents running and you can't answer what they can reach, that's the place to start. Happy to walk a Melbourne founder through what the audit covers. No deck, just the gaps.

You Dream, We Build.

Sources

Ravijeet Dang — AI-first business leader. This piece also appears on Substack and LinkedIn.

← All insights