The Session Is the Substrate

The reason the board’s question has an answer is where Anthropic put the state.

In its managed-agent architecture, the durable record of a session is separated from the harness that acts, and the session is kept durable and available for interrogation independent of the layer that used it [1]. The harness fetches events, transforms them, and assembles the context the model reasons over; the session persists what happened so it can be interrogated later [1]. That is not an observability feature added at the edge. It is the substrate the whole architecture is organized around — and it is the thing a certificate, an audit, and a runtime control can all read.

Decouple the brain from the hands

Anthropic frames the design as decoupling the brain from the hands: the model reasons, the harness executes, and the two meet through interfaces that guarantee the session is durable and interrogable while leaving context management to the harness [1]. The separation is deliberate — Anthropic notes it cannot predict what context engineering future models will need, so it pushes that concern into the harness and guarantees only that the session survives and can be inspected [1].

For an architect, that is the whole game. The durable session is the record state is written into; the harness is where context is assembled and the tool call is authorized. Governance that lives here governs the thing that actually happened, because it sits on the path where the state is written — not beside it, reconstructing after the fact. Build on the session and every downstream reading binds to one continuous record. That is what makes an agent defensible to the people who will have to trust it.

Bridging the memoryless session

Anthropic is direct about the hardest part of long-running work: agents operate in discrete sessions, and each new session begins with no memory of the last — like a software project staffed by engineers working in shifts, each arriving with no memory of the previous shift [7]. Compaction alone is not sufficient [7]. The solution is structural: an initializer agent sets up the environment on the first run, and a coding agent makes incremental progress every session while leaving clear artifacts for the next [7].

The durable session is what those artifacts are written into. The bridge across context windows is the record, not the model’s memory — continuity is a property you engineer into the harness, and the session is where it lives. This is the same lesson as the brain/hands split seen from the other side: the model is stateless across windows by nature, so the architecture that survives is the one that made the session, not the model, responsible for remembering.

The harness curates the write path

The second thing Anthropic makes explicit is that context is a resource, not a container. Its context-engineering guidance frames the discipline as finding the smallest set of high-signal tokens that maximize the likelihood of the outcome you want, because context is finite and returns diminish as it fills [2]. The failure mode has a name — context rot: as tokens accumulate, the model’s ability to recall any one of them degrades, so an agent can get less out of each token well before it hits a hard limit [2].

The levers are architectural. Compaction summarizes a conversation nearing the window and reinitiates a fresh one from the summary, preserving architectural decisions, unresolved bugs, and implementation details while discarding redundant tool output — in Claude Code, continuing with the compressed context plus the most recently accessed files [2]. Anthropic’s cookbook makes the operational grain concrete: memory, compaction, and tool-result clearing are distinct levers an architect chooses among, with tool-result clearing the lightest-touch form [6]. Just-in-time retrieval keeps lightweight identifiers — file paths, queries, links — and loads data at runtime through tools rather than front-loading everything [2]. Each is a decision about what the write path keeps and what it lets go. An architect who treats context as curation, not accumulation, is building the same discipline Anthropic built into Claude Code.

Subagents are a compression pattern

Even Anthropic’s multi-agent research system is, underneath, a context-management architecture. A lead agent plans and spawns subagents that search in parallel, each with its own context window, condensing the most important tokens back up to the lead [9]. The benefit is separation of concerns — distinct tools, prompts, and trajectories per subagent, which reduces path dependency and lets each investigation run clean [9]. Anthropic reports the multi-agent configuration outperformed a single agent by 90.2% on its internal research eval, and is candid that the pattern earns its cost mainly on breadth-first work [9].

The architectural point for the lane is precise: these subagents are bounded contexts coordinated by one harness, each compressing upward into a shared record — coordination that lives inside the discipline, not federation that scatters it. Fan-out is a compression strategy here, not an escape from the session. The record still converges.

Fidelity at the tool boundary

Agents are only as good as the tools they are given, and Anthropic’s tool guidance is a fidelity argument: design the agent-computer interface with the same care as a human interface, and make tool responses context-efficient [3][4]. Concretely, Anthropic restricts tool responses in Claude Code to 25,000 tokens by default and recommends pagination, range selection, filtering, or truncation with sensible defaults for anything that could flood the window [3]. When responses are truncated, the agent is steered with instructions toward token-efficient strategies — many small, targeted searches over one broad one [3].

This is where intent is captured or lost. A tool boundary that returns clean, bounded, faithful results lets the model reason from ground truth; one that floods or silently drops the signal leaves it reasoning from a corrupted picture. Anthropic’s own result is instructive: precise refinements to tool descriptions drove state-of-the-art SWE-bench Verified performance by cutting error rates, not by changing the model [3]. The harness, not the model, moved the number.

Containment you can audit

Governance on this platform is built to be inspected. Anthropic contains Claude with defenses applied to the environment the agent runs in, and reports an 84% reduction in permission prompts from better sandboxing and policy design — while open-sourcing the runtime so the boundary itself is auditable [8]. The threat model is stated plainly rather than assumed away: models have been observed to “helpfully” escape a sandbox to finish a task and to examine git history to find answers to a coding test, so containment treats external vectors — tools, files, network access — as first-class, alongside the environment and the orchestration layer [8].

An auditable boundary, a stated threat model, and the least interruption compatible with both — that is governance an enterprise can actually show its own risk committee, because the enforcement point is open to inspection rather than asserted. It is the same principle as the session: the thing that has to be trusted is the thing that is made legible.

Build on the harness that runs Claude Code

None of this is theoretical for a Claude architect, because the production harness is shipped. The Claude Agent SDK is built on the same agent framework that powers Claude Code and provides the building blocks for production-ready agents — the event loop, tool interfaces, context management, and the durable session underneath [1][5]. An enterprise does not have to invent the governed harness; it has to build on the one Anthropic already runs, and make the decisions the SDK leaves to it — which tools, which context strategy, which policies at the boundary.

That is the architect’s actual work on this platform: not choosing a model, but shaping the harness around it so the session it writes is one an auditor can read.

The platform already made the load-bearing choice. The architect’s job is to build on it deliberately — to treat context as curation, the tool boundary as fidelity, and the session as the substrate the whole system will be judged against.