Building General Purpose AI Agents with Agent Harnesses and Tool Runtimes

langchain_/_arcade · Tech · 2026 · source Agentic: yes · promotional bias: med · source-backed · extracted with prompt 0.5.5 (schema v2)

Generated from extraction.json — do not edit by hand. Every claim cites verbatim source evidence; stated means the quote directly asserts the claim, implied means it supports it indirectly.

Problem

Domain: Enterprise general-purpose agents

LangChain and Arcade describe how to move from single-user coding agents to enterprise-ready general-purpose agents. The system needs an agent harness that gives the model a workspace, planning, sub-agents, context management, and human-in-the-loop controls, plus a separate tool runtime that handles multi-user authentication, authorization, secrets, enterprise integrations, and delegated access to third-party services.

Constraints:

• Coding-agent patterns must generalize beyond one local user on a laptop to organizations and their users.
• The harness has to manage files, plans, sub-agents, large tool outputs, context compaction, and human approval without becoming just an LLM loop.
• External tools require user-specific authentication and authorization rather than unsafe service tokens or raw user tokens.
• Enterprise deployments need auditability, revocation, secret management, SSO, contextual access controls, and support for on-prem/VPC deployments.
• Models must be strong enough to actually drive rich tool harnesses; infrastructure alone does not make weak models useful agents.

Architecture

The architecture separates a LangChain Deep Agents harness from an Arcade tool runtime. Deep Agents supplies the agent workspace: file-system tools, pluggable real or virtual file backends, planning, sub-agents, skills, context offloading, compaction, and LangGraph human-in-the-loop/durable runtime capabilities. Arcade supplies the external execution layer: MCP gateway, tool registry, delegated authorization, secret injection, contextual access hooks, and integrations with enterprise services. Agent Builder then exposes the stack through a no-code chat interface that modifies agent definition files and connects agents to Arcade tools.

Diagram confidence: explicit (topology described by the source).

flowchart LR
  user-or-enterprise-admin[User or enterprise admin] --> agent-builder-interface[Agent Builder interface]
  user-or-enterprise-admin --> human-approval-inbox[Human approval inbox]
  agent-builder-interface --> deep-agents-harness[Deep Agents harness]
  agent-builder-interface --> agent-definition-files[Agent definition files]
  agent-builder-interface --> arcade-gateway[Arcade gateway]
  agent-definition-files --> deep-agents-harness
  deep-agents-harness --> file-system-workspace[File system workspace]
  deep-agents-harness --> planning-tool[Planning tool]
  deep-agents-harness --> sub-agent-workers[Sub-agent workers]
  deep-agents-harness --> context-manager[Context manager]
  deep-agents-harness --> langgraph-runtime[LangGraph runtime]
  deep-agents-harness --> arcade-gateway
  context-manager --> file-system-workspace
  langgraph-runtime --> human-approval-inbox
  arcade-gateway --> arcade-tool-runtime[Arcade tool runtime]
  arcade-gateway --> tool-registry[Tool registry]
  arcade-tool-runtime --> authorization-store[Authorization store]
  arcade-tool-runtime --> secret-store[Secret store]
  arcade-tool-runtime --> enterprise-policy-hooks[Enterprise policy hooks]
  arcade-tool-runtime --> third-party-services[Third-party services]

Components

Data flow

A user or organization creates an agent through Agent Builder or a Deep Agents harness. The agent definition lives as files such as agent.md, skills, subagents, and mcp.json. During execution, the harness plans, reads and writes workspace files, spawns isolated sub-agents, offloads large tool results to files, compacts history when context grows, and interrupts for human approval on risky tools. When the agent needs an external service, it calls through an Arcade gateway. The runtime checks authentication, delegated authorization, secrets, and contextual enterprise policies, then executes the selected third-party tool as the authorized user and returns results to the harness.

Why this architecture

The split keeps local agent cognition and enterprise external access under different control planes. The harness handles the environment the model reasons in, including files, planning, skills, context, and approvals. The runtime handles the external world, where user identity, delegated permissions, secrets, service integrations, and revocation matter. This separation lets a general-purpose agent use coding-agent primitives while still satisfying enterprise security requirements that local MCP servers or raw tokens cannot meet.

Models used: OpenAI models · Anthropic models · open-source models · GLM · Kimmy

Scale

• Arcade exposes more than 8,000 tools through the Agent Builder integration.
  “Over 8,000? Okay, you can connect to over 8,000 tools through there as well.”transcript, stated
• Deep Agents includes six file-system operations.
  “these are the six that we have in Deep Agents. We have uh list, read, write, edit, glob, and grep.”transcript, stated
• Large tool outputs are summarized by showing the first 100 lines and putting the full result in a file.
  “we'll actually just put that in a file, show you the first 100 lines, say, "Here you go. If you want to see more, you can read the file."”transcript, stated
• The Agent Builder email assistant had been used for about a year and a half.
  “I I was using it I've been using it for like a year and a half.”transcript, stated
• The tool-pattern guidance reflects about two and a half years of tool-building lessons.
  “things we've learned about building tools since the past 2 and 1/2 years.”transcript, stated
• The architecture supports deployments entirely inside a company's VPC.
  “there are companies that deploy everything we're talking about today entirely inside the VPC.”transcript, stated

Alternatives considered (roads not taken)

Treat an agent as only an LLM loop with tools.

Rejected because: The speakers argue production agents need a harness with planning, files, sub-agents, context management, and human approval beyond the bare loop.

Run agents directly against a local file system only.

Rejected because: A virtual or pluggable file backend enables remote, sandboxed, and database-backed operation while preserving the file-system interface agents know.

Use service tokens for enterprise tool access.

Rejected because: Service tokens are either over-privileged enough to block enterprise adoption or too under-privileged to make agents useful.

Give agents full user tokens or secrets through environment variables.

Rejected because: The runtime instead delegates a scoped subset of user permissions and injects named secrets at execution time to reduce credential exposure.

Expose all write-capable tools to agents automatically.

Rejected because: Agent Builder defaults write operations into human-in-the-loop approval so confused or prompt-injected agents cannot automatically perform risky actions.

Use only terminal interfaces for general-purpose agents.

Rejected because: The speakers argue non-developer users need more approachable chat/no-code interfaces such as Agent Builder.

Patterns

tool-use-orchestration (agent-architecture)

The system treats tool use as two layers: the harness exposes local workspace/tool primitives to the model, while Arcade exposes authenticated external services through a gateway/runtime.

multi-agent-orchestration (agent-architecture)

Deep Agents supports sub-agents that work on isolated tasks in parallel and report only final results to the main agent.

agent-memory (state-management)

Agents are represented as files and Agent Builder evolves their memory/definition by editing those files over time.

context-compaction (context-management)

The harness offloads large tool outputs and saves original messages during compaction so the agent can recover details without filling the context window.

human-in-the-loop-gate (safety)

LangGraph/Deep Agents expose human approval controls, and Agent Builder defaults write operations such as sending email into approval flows.

privacy-preserving-processing (security)

Arcade scopes tokens, stores secrets outside the model context, and checks delegated permissions at runtime rather than exposing broad credentials.

safety-policy-enforcement (security)

The runtime enforces per-tool privilege checks, enterprise policies, verifiers, and revocation or step-up authorization flows for sensitive operations.

durable-execution (infrastructure)

Deep Agents inherits LangGraph's durable execution, streaming, persistence, and interrupt capabilities as the runtime substrate beneath the harness.

Tradeoffs

Split local agent harness from external tool runtime.

Chose separate harness and runtime responsibilities over one layer that handles both model workspace and enterprise integrations.

Rationale: The harness and runtime have different responsibilities: the harness controls local agent capabilities, while the runtime handles authentication, authorization, and integrations that are inseparable once an agent acts as an intermediary.

Represent agents through files.

Chose agent.md, skills, subagents, and mcp.json as agent definitions over opaque in-memory or database-only agent configuration.

Rationale: File-based definitions align with coding-agent workflows, let the harness inspect and modify definitions, and let Agent Builder evolve agents conversationally.

Use a pluggable file backend.

Chose real or virtual file system abstraction over hard-coded local file-system access.

Rationale: The abstraction preserves the file model agents understand while enabling database-backed state, remote execution, and sandboxing.

Delegate scoped permissions instead of sharing broad user credentials.

Chose delegated agent authorization over raw user tokens or broad service tokens.

Rationale: Delegation gives each agent the least privileges required for a specific user, company, service, and time, while producing an auditable authorization record.

Default write operations into approval.

Chose human-in-the-loop for write tools over fully automatic execution of write-capable tools.

Rationale: Write operations such as sending email are useful but risky, so the system keeps the user in the loop unless designers explicitly loosen that control.

Support both user-pass-through and agent identity directions.

Chose infrastructure that can handle user identity and emerging agent identity over assuming agents always act only as the current user.

Rationale: The speakers describe both personal pass-through credentials and emerging agent identities with their own memory and credentials as important future modes.

Gotchas (what bit them)

Sub-agent isolation can fail if task handoffs are underspecified.

Root cause: A sub-agent sees only its assigned task and the main agent sees only the final result, so instructions and returned information must be precise.

Resolution: Treat sub-agent prompts and response formats as explicit contracts between main and sub-agent.

Naive tool outputs can quickly exhaust context.

Root cause: Large JSON results and accumulated history consume the model context window automatically.

Resolution: Offload large tool results and original messages to files, show only a preview, and let the agent read details when needed.

Service-token patterns do not map well to enterprise agents.

Root cause: A service token is usually either too powerful for security approval or too weak for useful agent work.

Resolution: Use delegated agent authorization with least-privilege scoped permissions per agent, user, service, and time.

Legitimately authorized tools can still be used dangerously by a confused or prompt-injected agent.

Root cause: Authorization alone does not prove the agent's proposed action is safe or intended.

Resolution: Use guardrails, human approval for write tools, and custom verifiers on authorization flows.

Revocation and temporary delegation become operationally hard when employees leave or go on vacation.

Root cause: Agents may depend on a specific user's permissions, leaving managers without visibility or the ability to continue workflows.

Resolution: Build runtime authorization checks, revocation, and step-up flows that delegate exact permissions to a new authorized user.

Open-source models may not yet reliably drive complex agent harnesses.

Root cause: Tool-rich harnesses require strong model capabilities; infrastructure cannot compensate for poor tool-use reasoning.

Resolution: Benchmark models on Deep Agents and use stronger OpenAI or Anthropic models when performance matters.

Evaluation

The talk does not present a formal product evaluation harness, but it does describe operational validation through real enterprise use cases, security reasoning, model benchmarking, and default guardrail behavior. The teams test whether models can reliably drive Deep Agents, compare frontier and open-source model performance, and validate enterprise requirements such as delegated authorization, step-up flows, revocation, and VPC deployment.

Metrics: number of available tools · file-system operations supported · model ability to use the harness tools · enterprise authorization coverage · write-operation approval defaults · VPC deployment support · revocation and step-up authorization support

Outcomes

• LangChain positioned Deep Agents as a batteries-included harness on top of LangGraph.
• Deep Agents supports file-system tools, pluggable backends, planning, sub-agents, skills, context offloading, compaction, and human-in-the-loop controls.
• Arcade provides delegated authorization, secret storage, contextual access hooks, MCP gateway composition, and enterprise tool-runtime infrastructure.
• Agent Builder combines the harness and runtime into a no-code agent-building surface with access to Arcade tools.
• The email assistant, LinkedIn recruiter, social media agent, and flight-booking examples illustrate practical general-purpose and enterprise workflows.

The case names six Deep Agents file operations, first-100-lines previews for large tool outputs, over 8,000 Arcade tools, one-and-a-half years of email-assistant use, two-and-a-half years of tool-building lessons, and deployments entirely inside enterprise VPCs.