Vinoth Govindarajan, a Member of Technical Staff at OpenAI, presented a framework for production AI agent reliability that moves beyond model quality to focus on the control plane—the system that decides what an agent can actually do. The talk, delivered at QCon AI Boston in September 2026, centers on five operational patterns: establishing explicit state ownership, serializing concurrent state mutations, scoping execution authority, bounding work with timeouts and cancellations, and validating actions at the user-visible edge. These are not model problems; they are harness problems, and they determine whether an agent system survives production or silently fails in ways users notice but operators cannot explain.
The failure mode Govindarajan opens with is instructive: a user sees the agent reply, but the system forgets it happened. The user asked the agent to remember a refund for a customer. The assistant confirmed it would remember for the next turn. From the user's perspective, nothing looked wrong—no error, no crash, no red screen. Behind the scenes, the turn routed through a delivery path that succeeded but never persisted into the session record the agent would need to reconstruct context on the next turn. The user-visible edge and the durable edge disagreed. This is worse than a crash because a crash gives you a boundary; silent success is a lie. The operator has no reason to doubt the system lost part of its memory, and the future context inherits a hole.
The production contract Govindarajan proposes is simple: a model proposes, the harness commits, and the receipt proves it. The harness is the system around the model that lets it output safely into the real world. Once an agent can send a message, update a database, run a command, or trigger a workflow, three questions replace the single question of whether the model answered correctly. Who owned the state—which memory pipeline or workflow is the source of truth? Who committed first—what is the order when two events arrive together? Who can show what happened—not what the model intended, but what the user-visible edge persisted?
State ownership means every fact the agent might use in a future turn has one owner and one replay path. If the system cannot reconstruct the fact later, it does not really own it. The second incident Govindarajan describes involved a heartbeat mechanism—an internal liveliness signal—that crossed into user-facing work. A timer fired, the agent woke up, and if nothing interesting happened, it should have suppressed the output. Instead, the heartbeat token became a pending delivery item. The next heartbeat saw pending work already happening and skipped. The bug was not that the model failed; it was that a state machine classified an internal signal as user-deliverable work. The fix did not make the agent smarter; it made the state machine stricter.
Serializing concurrent state mutations becomes critical when multiple inputs arrive at the same time: user corrections, webhook replays, heartbeats, sub-agent completions, and tool results can all be valid events, but they can interleave in invalid ways. One OpenClaw incident involved two correct writes to the same commitment store. One caller loaded state, modified field A, and saved. Another caller loaded the same original state, modified field B, and saved. Neither writer was malformed. Because there was no serialization around the read-modify-write cycle, the last save erased the first modification. The pattern is to serialize same-process writes with a queue and protect cross-process writes with a lock. The invariant is narrow: one ordered commit path per mutable state. Concurrency is fine—you can parallelize reads, fan out subtasks, and run many sessions in parallel. What you cannot do is have two writers touch the same mutable boundary without order. Without it, user experience becomes timing as personality. Sometimes the agent feels successful; sometimes it feels haunted.
Bounding work means no tool call, lane, loader, or stream gets infinite time. Silence cannot be neutral. One incident involved a dangling tool call: the session log recorded that it called an external tool, but the matching result never arrived. Maybe the process was killed, the network dropped, or the tool timed out. The production failure is that the loop is still waiting behind the silence. Future messages enter the session, but the loop is still waiting for output that will never arrive. To the user, the assistant looks slow or stuck. For the system, there is no terminal event to move past. Every boundary needs an ending: success, failure, timeout, or max attempts. A lease gives runs and tools a deadline. A watchdog turns stuck work into a visible agent failure. A receipt records a terminal state so the next step does not have to guess.
Scoping execution authority means approval becomes a scoped object, not a vague memory of a click. When a user approves elevated execution, that approval needs shape: actor, session, tools, arguments, lifetime, and outcome. If any of these fall across transport or replay, the harness no longer knows what was actually approved. One OpenClaw example showed a disabled tool that still registered as available to the runtime. The policy surface and the runtime surface diverged. The UI said the capability was not allowed, but the provider still registered it. The model could see a request for something the operator thought was disabled. The pattern is that requester identity, capability, and execution authority have to converge before the model sees a prompt. Otherwise, policy is decoration, not a boundary.
Validating actions at the user-visible edge means the user-visible edge must confirm the outcome. One incident involved a tool that returned success, but the user saw nothing rendered. The message tool reported was send succeeded. The metadata looked like it had delivered to the current WebChat or TUI run, but the user did not see the message. This is not a small mismatch; it changes the conversation. The assistant can later say it already sent the explanation. From the tool's point of view, success was reported. From the user's point of view, nothing happened. The difference between a transcript and a receipt is that a transcript says what the agent said, a tool return says what the tool claimed, and a receipt says what the user-visible edge actually confirmed. Internal success is not external proof.
Govindarajan proposes an audit for any agent system: Can you replay the fact from its owner of record? Can you explain the order rule under concurrent writes? Can you terminate stuck work without killing the channel? Can you exactly name the authority envelope—actor, session, tool, argument, lifetime, outcome? Can you prove what the user-visible edge saw as outcome? If you cannot answer these, the next feature should not be a bigger model or better tool surface; it should be a clearer harness. For teams deploying autonomous systems with human oversight, the takeaway is direct: own the state, serialize mutations, scope authority, bound the work, and validate at the user-visible edge—these are the harness responsibilities that separate a production system from an impressive demo.