The exoskeleton around the model: why defence AI needs a harness, not just guardrails.

AI is going to keep spreading into places we used to think were off limits. Defence and national security are two of those places. Realistically, the question was never going to be whether AI enters these spaces. It was always going to be how we make sure it enters safely.

That "how" matters more than most conversations about AI give it credit for. We talk a lot about balancing safety and efficiency, and in most contexts that balance can lean toward efficiency without much consequence. In defence, it can't. The cost of getting it wrong is too high, and the margin for a bad decision made at machine speed is basically zero.

Minister Josephine Teo recently spoke on the risks of autonomous AI agents. She pointed out that the safety regimes we have today were built around human error. Agentic AI doesn't fail the way humans fail. The risks, the failure modes, the ways things go wrong are not yet fully understood, even by the people building these systems. That's not a comfortable thing to hear from a minister overseeing digital policy, but it's an honest one.

At the Digital Defence Symposium here in Singapore, Permanent Secretary for Defence Joseph Leong made a similar point from a different angle. He talked about AI moving from being "just a tool" to being "an actor in its own right." Agentic systems that can evaluate, decide, and execute without a human checking every step. He put it plainly: machines cannot carry responsibility, people and institutions must.

"Machines cannot carry responsibility. People and institutions must."

That line is the whole problem in one sentence. As AI takes on more of the deciding, someone still has to own what it decides. The accountability doesn't disappear just because a human isn't clicking the button anymore.

01So how do you actually build that in?

This is where a good model harness shines. The United Nations University published a report that framed it this way: a harness is the scaffolding around a model, the layer that decides how the model receives context, what tools it can call, what actions require approval, and what gets logged along the way.

Here's the part that matters most. The model itself is fixed. You can't reach into Claude or GPT-5 or an open-source model like DeepSeek and rewire its internal weights to behave the way you want on a specific task. Whatever blind spots or quirks the base model has, they're baked in. What you can control is everything around it. The harness is the layer where governance actually lives, because it's the only layer you have full authority over.

02What this looks like in a defence context

Take an air strike request as an example to give a clear illustration of why this matters. A request for an airstrike doesn't just get approved because someone typed it in. It has to move through a chain of command, get assessed for necessity, get checked for accuracy, and at every single point along that chain, there has to be a human who can say no.

A model harness is what enforces that chain when AI is part of the workflow. While models might possess underlying guardrails, those are pre-written and not customisable. With a model harness we do not need to solely rely on the model, because the harness itself can dictate the process to stop and wait for a human sign-off at the point where a sign-off is required, every time, without exception. It is less a blunt tool like a boundary that cannot be crossed, and more an exoskeleton that guides the model's actions to follow a structured, safe process. The model can reason, propose, analyse. It cannot skip a step the harness says it isn't allowed to skip.

Minister Teo's warning about safety regimes being built for human error is exactly why this design matters. A human who skips a step usually does it visibly, and someone downstream can catch it. An AI agent that skips a step might do it quietly, at speed, across a chain of actions that no one is watching closely enough to notice until it's already a problem. A well-built harness closes that gap by making the skip structurally impossible rather than hoping someone notices in time.

03Where Trusted Hub comes in

This is a big part of what we actually do. When we take on a project, we're not just handing over a model and a workflow and calling it done. We sit down and work through what the task actually requires, what the constraints are, where human approval has to sit, and what absolutely cannot be allowed to happen without a person in the loop. Then we build a harness around the model that enforces exactly that.

A lot of organisations don't have the internal expertise to articulate what they actually need from a model, and that's not a knock on them. Translating a business requirement, or a defence requirement, into a precise set of operational boundaries for an AI system is a specific skill. It's part engineering and part knowing the right questions to ask. That translation is a core part of what we do at Trusted Hub. We take your objectives and your restrictions and turn them into a system that respects both, every step of the way.

The push into defence and national security isn't going to slow down, and there's no version of the future where it does. What we can control is whether the systems doing that work are built with the discipline this space demands. That starts with the harness, not the model.