User-programmable behavioral rules
at the harness layer.
Mode is investigating whether user-defined behavioral rules enforced at the harness layer, below the context window, above the orchestration floor, produce more persistent and reliable compliance than equivalent rules expressed through prompts, system instructions, or memory systems.
The research question
Do user-defined behavioral rules enforced at the harness layer produce more persistent and reliable compliance over extended sessions than equivalent rules expressed through prompts, system instructions, or memory systems, and what are the security properties of this layer separation?
Current AI systems give users one mechanism for defining behavioral preferences: text placed inside the model's context window. This mechanism is inherently fragile. Mode is investigating whether a programmable layer below the context window, evaluated by the orchestration layer before every action, produces meaningfully different compliance outcomes, and whether the security properties of that separation can be characterized empirically.
Why existing approaches fall short
User-defined behavioral rules face structural reliability problems that are inherent to where those rules live, not to how they are written.
Rules inside the context window degrade with session length
System prompts, instruction files, and memory systems all place user-defined rules inside the model's context window. These rules face the same degradation as any context-window content: as sessions extend across many tool calls and agent turns, earlier content is compressed, summarized, or dropped. A behavioral rule present at session start may not be reliably retrievable 50 tool calls later. This is a structural failure mode, not an adversarial one, no attack is required. The model may simply no longer have reliable access to the rules it was given.
Existing runtime enforcement tools require developer expertise
Published runtime enforcement research provides powerful tools for specifying agent behavior, but all of them are developer-facing. AgentSpec requires writing a domain-specific language. Agent Behavioral Contracts require formal preconditions and invariants. Runtime Governance defines compliance policies as functions on execution paths. These tools require technical expertise to configure and provide no user-accessible interface for defining behavioral preferences. Non-technical users have no access to enforcement-layer configuration in any published system.
Natural-language policy translation introduces inconsistency
Research on executable governance addresses converting natural-language policies into machine-readable enforcement rules. When a user defines a behavioral preference in natural language and it must survive a model-interpretation step before reaching the enforcement layer, that interpretation may be inconsistent across invocations. Rules that exist as natural-language prompts face this translation problem on every model call. Harness-layer rules bypass model interpretation entirely: the orchestration layer evaluates them directly, with no translation step and no interpretation variance.
Mode's approach
Mode Agent provides a user-accessible configuration layer below the context window, evaluated by the orchestration layer before every agent action.
Below the context window
User-defined rules are stored and evaluated at the harness layer, independent of what any model's context contains. They cannot be degraded by context compression, summarization, or truncation because they never enter the context window in the first place.
Evaluated before every action
The orchestration layer checks user-defined rules against every proposed agent action before execution proceeds. Compliance is enforced structurally, not instructed. A rule that says an agent cannot access certain resources is checked on every action, not hoped to be remembered.
No developer expertise required
User-programmable rules are designed for non-technical configuration. The harness layer handles translation from user intent to enforcement logic, the same translation that currently happens inconsistently inside model context windows happens once, deterministically, at the harness layer.
The Agent retains priority
User-defined rules operate within the Agent's enforcement floor. Orchestration-layer safety boundaries override user rules when they conflict. This layered architecture ensures user configurability without compromising the structural safety guarantees the Agent provides.
The gap in existing research
Existing runtime enforcement research addresses developer-defined formal specifications compiled into enforcement rules before deployment. No published work measures whether user-programmable rules at the harness layer produce meaningfully different compliance outcomes compared to equivalent prompt-based rules, particularly over extended sessions where context-window degradation accumulates.
Mode Agent is the only system with both a user-facing rule configuration layer and an enforcement mechanism below the context window. The comparison between harness-layer rule compliance and prompt-based rule compliance over extended sessions has never been measured. This research produces that measurement, and characterizes the security properties of the layer boundary itself.
What we are measuring
Our evaluation framework compares harness-layer rule compliance against prompt-based rule compliance for identical behavioral rules across extended sessions.
Primary metrics, directly answer the research question.
Compliance rate over session length
What percentage of agent actions comply with user-defined rules as a function of session length, comparing harness-layer rules against equivalent prompt-based rules.
Compliance drift
How much compliance rate changes from session start to session end for both conditions. Harness-layer rules should show no drift. Prompt-based rules are expected to degrade.
Layer security properties
Under adversarial input targeting user-defined rules, what percentage of attempts successfully override harness-layer rules vs. prompt-based rules. Quantifies the security benefit of layer separation.
Secondary metrics, characterize usability and rule system behavior.
Configuration error rate
How often user-defined rules produce unexpected behavior due to misconfiguration, a measure of whether the rule system is usable by non-technical users.
Rule interaction conflicts
How often multiple user-defined rules conflict with each other or with the Agent's enforcement floor, and how the resolution behavior compares to user intent.
False positive rate
What percentage of legitimate, user-intended actions are incorrectly blocked by user-defined harness-layer rules, indicating over-specification.
Related work
The research below establishes the enforcement landscape, motivates the user-programmability gap, and defines what this work adds.
Runtime Governance for AI Agents: Policies on Paths
Defines a formal framework for runtime agent governance, treating compliance policies as deterministic functions on execution paths and connecting per-step evaluation to organizational risk objectives. Developer-facing framework requiring formal policy specification.
arxiv.org/abs/2603.16586. March 2026AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents
Introduces a domain-specific language for runtime constraint enforcement. Achieves over 90% prevention of unsafe executions with millisecond overhead. Demonstrates that enforcement below the context window works, but requires developer-level rule specification.
arxiv.org/abs/2503.18666. March 2025Governing What You Cannot Observe: Adaptive Runtime Governance for Autonomous AI Agents
Introduces the Agent Viability Framework with three properties, monitoring, anticipation, and monotonic restriction, as necessary and sufficient conditions for governing autonomous agents. Addresses the challenge of enforcing compliance over actions that cannot be fully observed before execution.
arxiv.org/abs/2604.24686. May 2026Executable Governance for AI: Translating Policies into Rules Using LLMs
Develops P2T, a pipeline for converting natural-language policy documents into normalized, machine-readable rules. Demonstrates the translation challenge: natural-language policy intent must survive a conversion step to reach enforcement. Harness-layer user rules eliminate this step.
arxiv.org/abs/2512.04408. December 2025Agent Behavioral Contracts: Formal Specification and Runtime Enforcement for Reliable Autonomous AI Agents
Introduces formal preconditions, invariants, and recovery mechanisms for autonomous agents. Contracted agents detect 5.2 to 6.8 soft violations per session that uncontracted baselines miss entirely. Establishes the empirical case for enforcement-layer rule specification over prompt-based rules.
arxiv.org/abs/2602.22302. February 2026