"I've never seen anything scarier than an LLM with tool calls." — Erik Meijer aka @HeadinTheBox

Tool use lets an agent cause side effects before it returns an answer. The proposed harness instead **defers execution**, converts the plan into an inspectable program, checks constraints, and only then runs it.

Builders granting agents filesystem, database, or network access should treat the harness as the safety boundary. Represent actions in a restricted language that supports type checking, data-flow analysis, and taint analysis before execution.

The talk presents a design principle based on **proof-carrying code**, not evidence that arbitrary real-world agent behavior can already be proved safe. Useful guarantees depend on whether the action language and its safety properties capture the actual risks.