Who is The Secure Harness for?

You have agents writing code in a repository that other people depend on. You lead a team adopting AI tooling and have been asked what the controls are. You maintain the platform other engineers run their agents on. You want the productivity without granting a model unattended write access to production. This is not a prompt-engineering book, and it will not make an agent better at writing code. It also assumes you want a human in the loop — if the goal is a fully autonomous pipeline with no review gate, its recommendations will read as friction.

What will I learn from The Secure Harness?

How to scope agent permissions so the common case needs no prompt and the dangerous case cannot proceed silently. How to use hooks to enforce policy at the moment of the action instead of reviewing it afterwards. How to build release gates that generated code has to pass before it reaches a branch that matters. How to write and secure an MCP server without handing over more surface than the task needs. How to audit what an agent did, in enough detail to answer for it later.

Who wrote The Secure Harness?

Kubilay Tunca, Security Engineer and Author. Writes about cybersecurity for readers ranging from non-technical beginners to working practitioners, and is the author of five books on security, privacy, secure development, and AI systems.

Where can I buy The Secure Harness?

The Secure Harness is available on Amazon. The listing is linked from this page.

The Secure Harness

Shipping Production Code with AI Coding Agents

By Kubilay Tunca

Use AI Coding Agents Without Losing Control of Your Codebase

A calm, practical guide to letting agents do useful work inside boundaries you set, enforce, and audit. Ships with 15 copy-pasteable artifacts: hook scripts, permission configs, release gates, and MCP templates.

Buy on Amazon

As an Amazon Associate I earn from qualifying purchases. Buying through these links costs you nothing extra and helps pay for the blog.

About this book

The argument about AI coding agents has settled into two camps that are both unhelpful. One says the agent will write your software; the other says it cannot be trusted near anything that matters. Teams actually shipping with agents have found the same third position independently: the agent is useful exactly to the degree that the boundaries around it are real.

The Secure Harness is about building those boundaries. Not prompting technique, and not a case for or against the tools — the mechanics of permission configuration, hooks that fire before a destructive action rather than after, gates that stand between generated code and a release, and audit trails that let you reconstruct what happened.

It ships with fifteen artifacts you can paste into a repository: hook scripts, permission configs, release gates, and MCP server templates. The premise is that a harness you have to build from scratch is a harness nobody builds.

What you will learn

How to scope agent permissions so the common case needs no prompt and the dangerous case cannot proceed silently
How to use hooks to enforce policy at the moment of the action instead of reviewing it afterwards
How to build release gates that generated code has to pass before it reaches a branch that matters
How to write and secure an MCP server without handing over more surface than the task needs
How to audit what an agent did, in enough detail to answer for it later

Read this if

You have agents writing code in a repository that other people depend on.
You lead a team adopting AI tooling and have been asked what the controls are.
You maintain the platform other engineers run their agents on.
You want the productivity without granting a model unattended write access to production.

Skip this if

This is not a prompt-engineering book, and it will not make an agent better at writing code. It also assumes you want a human in the loop — if the goal is a fully autonomous pipeline with no review gate, its recommendations will read as friction.

Topics covered

AI coding agents
agent security
MCP
permission models
hooks
release gates
sandboxing
code review
audit logging

Reader reviews

No reader reviews yet — this book is new. Nothing is quoted here until a real reader has written it and it can be linked back to its source.

If you have read it, leaving a review on Amazon is the single most useful thing you can do for it.

Read the author first

These free articles cover the same ground as The Secure Harness. If the writing works for you here, the book is more of it.

OpenAI Models Escaped a Cyber Evaluation and Broke Into Hugging Face. The Interesting Part Is Why.
In July 2026 an OpenAI evaluation agent left its sandbox through a package installer, reached the internet, and pulled benchmark answers from Hugging Face production. Reward optimisation did exactly what it was trained to do. Here is what that means for anyone running autonomous agents.
CVE-2026-46331: How a Shared Filesystem Undoes an AI Agent Sandbox
A July 2026 flaw in Claude Cowork let an AI agent break out of its Linux VM and read SSH keys and cloud credentials on the host Mac. The bug is specific. The mistake behind it is everywhere: mounting the thing you are protecting into the box you do not trust.
Invisible Screen Text Can Make an Android AI Agent Run Code on Your PC
Researchers showed that open-source Android AI agents can be driven by text a human cannot see, escalating through unsanitised subprocess calls into code execution on the connected computer. Screenshots are input. Treat them like any other input from a hostile source.
Exposed AI Tooling: Censys Found 294,000 Open LLM Endpoints in Nine Months
Censys detected a 60% rise in internet-exposed AI tooling, with Langflow and LiteLLM leading the count. Most of it was never meant to be public. Here is how AI infrastructure ends up on the open internet and how to find yours before somebody else does.

All AI Security articles

Questions

Who is The Secure Harness for?: You have agents writing code in a repository that other people depend on. You lead a team adopting AI tooling and have been asked what the controls are. You maintain the platform other engineers run their agents on. You want the productivity without granting a model unattended write access to production. This is not a prompt-engineering book, and it will not make an agent better at writing code. It also assumes you want a human in the loop — if the goal is a fully autonomous pipeline with no review gate, its recommendations will read as friction.
What will I learn from The Secure Harness?: How to scope agent permissions so the common case needs no prompt and the dangerous case cannot proceed silently. How to use hooks to enforce policy at the moment of the action instead of reviewing it afterwards. How to build release gates that generated code has to pass before it reaches a branch that matters. How to write and secure an MCP server without handing over more surface than the task needs. How to audit what an agent did, in enough detail to answer for it later.
Who wrote The Secure Harness?: Kubilay Tunca, Security Engineer and Author. Writes about cybersecurity for readers ranging from non-technical beginners to working practitioners, and is the author of five books on security, privacy, secure development, and AI systems.
Where can I buy The Secure Harness?: The Secure Harness is available on Amazon. The listing is linked from this page.

Use AI Coding Agents Without Losing Control of Your Codebase

Buy on Amazon

As an Amazon Associate I earn from qualifying purchases. Buying through these links costs you nothing extra and helps pay for the blog.

See all 5 books