It’s just the wrong analogy. Harnesses, for the most part, extend an agent’s capabilities and better ground them in the real world through tools and the ability to check external sources, rather than restricting them.

Yet one of the reasons harnesses abstract tool calls is to control what agents can do instead of just yoloing commands and inline python scripts. It's such a central feature, and agents are so hard to control, that harnesses like claude code and codex use an AI classifier to additionally auto-approve tool calls.

It’s both. A harness that enforces valid json to be returned ”restricts” the model.

Okay but is that a relatable sound bite that will make someone click a link? No.