How Decoupling the “Brain” and “Hands” Transforms Agent Architecture and Cuts First‑Token Latency by 60%

Agent Component Coupling: From Convenience to Bottleneck

Early implementations of Agent systems placed the session, harness (scheduling loop), and sandbox (code execution environment) in the same container for simplicity, avoiding inter‑service communication. However, when the container crashes or becomes unresponsive, the entire session state is lost, debugging requires manual log inspection inside a container that also holds user data, and the architecture assumes all resources run in the same network, limiting deployment flexibility.

Separate the “Brain” and “Hands”: Three Interfaces Replace One Container

Anthropic’s April engineering blog describes splitting the system into three independent components:

session – an append‑only event log that records every action independent of any process.

harness – a stateless loop that reads events from the session, calls the model, routes tool calls to the appropriate execution environment, and writes results back.

sandbox – a disposable execution environment invoked via a uniform interface execute(name, input) → string.

This separation makes each component replaceable and independently recoverable.

Containers Become Cattle, Not Pets

With the new design, sandboxes are treated as cattle: they can be created, discarded, or replaced at will. Harnesses also become cattle; because the session stores all state, a harness can be restarted with a simple call wake(sessionId) that reads the event log and resumes scheduling.

Performance improves because sessions no longer need to spin up a full container when sandbox execution isn’t required. Anthropic’s public data shows the P50 Time‑to‑First‑Token (TTFT) drops by roughly 60% and the P95 by over 90%, shrinking the perceived start‑up time from seconds to sub‑second.

Security Model Shifts from Policy Patch to Structural Guarantee

In the coupled architecture, generated code runs in the same container that holds credentials, making token leakage inevitable. The decoupled design introduces two patterns:

"Credentials travel with the resource, not the Agent" – e.g., a sandbox clones a repository using an access token that is visible only to the inner shell, never to the Agent.

"Credentials stored in a vault and forwarded by a proxy" – tools like MCP keep OAuth tokens in an isolated vault; the harness never sees them directly.

Both patterns create a structural isolation layer that prevents the model from ever accessing sensitive tokens, a more reliable safeguard than runtime policy checks.

Session Is Not a Context Window

Long‑running Agent tasks often exceed the model’s context window. Traditional approaches (compaction, memory tools, context trimming) are irreversible. The new architecture treats the session as an object outside the context window, exposing getEvents() so the harness can slice the event stream on demand, replay prior decisions, or perform custom context engineering before feeding data to the model.

Three Engineering Takeaways for Agent Developers

1. Distinguish what must stay alive from what can die. The session log is the only immutable, persistent artifact; everything else should be replaceable.

2. Use interfaces instead of configuration to handle change. A generic execute(name, input) → string abstraction lets sandboxes run in containers, VMs, phones, or embedded devices without altering the harness.

3. Put security boundaries in the architecture, not in policy. Physically isolate credentials from the Agent’s execution environment, ensuring the model cannot reach them regardless of its capabilities.

These principles echo the operating‑system design philosophy of separating program interfaces from hardware implementations, enabling future evolution of models, harness strategies, and execution environments without breaking existing systems.