---
title: DigitalOcean Harness Runtime Concepts (public)
description: Explanations of Harness Runtime environments, sandboxes, sessions, runs, adapters, permissions, approvals, secrets, and network egress.
product: Managed Agents
url: https://docs.digitalocean.com/products/managed-agents/agent-harness-runtime/concepts/
last_updated: "2026-09-21"
---

> **For AI agents:** The documentation index is at [https://docs.digitalocean.com/llms.txt](https://docs.digitalocean.com/llms.txt). Markdown versions of pages use the same URL with `index.html.md` in place of the HTML page (for example, append `index.html.md` to the directory path instead of opening the HTML document).

# DigitalOcean Harness Runtime Concepts (public)

Generated on 25 Sep 2026

DigitalOcean Harness Runtime combines the functionality of a lightweight microVM, built-in tools like chromium and a coding sandbox needed by agents to do work. The product offers rich lifecycle APIs that persist conversational history and working state across sessions, with pause/resume/fork semantics so that developers can control costs and adapt workflows to the nonlinear quirks of agentic work. See [What You Can Build](https://docs.digitalocean.com/products/managed-agents/agent-harness-runtime/details/what-you-can-build/index.html.md) for example use cases.

[DigitalOcean Harness Runtime Overview](https://docs.digitalocean.com/products/managed-agents/agent-harness-runtime/concepts/overview/index.html.md): Harness Runtime runs Codex CLI, Claude Code, OpenCode, LangGraph, and Hermes in isolated DigitalOcean sandboxes, configured with a YAML environment spec or the Control Panel and driven with doctl.

[Managed Agents Architecture](https://docs.digitalocean.com/products/managed-agents/agent-harness-runtime/concepts/architecture/index.html.md): How Harness Runtime, Action Gateway, and the DigitalOcean services around them fit together to run and govern AI agents.

[Agent Adapters](https://docs.digitalocean.com/products/managed-agents/agent-harness-runtime/concepts/agent-adapters/index.html.md): Harness Runtime adapters select which coding agent or framework runs in the sandbox and which platform features, such as approvals and checkpoints, apply to the session.

[Environments and Sandboxes](https://docs.digitalocean.com/products/managed-agents/agent-harness-runtime/concepts/environments/index.html.md): A Harness Runtime environment is a reusable configuration object defining what an agent needs to do work, and a sandbox is the isolated microVM a session provisions from it.

[Sessions](https://docs.digitalocean.com/products/managed-agents/agent-harness-runtime/concepts/sessions/index.html.md): A Harness Runtime session is one running instance of an environment, with its own sandbox, state, and history, and a run is a single agent turn inside it.

[Permission Policies](https://docs.digitalocean.com/products/managed-agents/agent-harness-runtime/concepts/permissions/index.html.md): Harness Runtime permission policies allow, require approval for, or deny the actions an agent takes, and set the filesystem and network access of the sandbox it runs in.

[Approvals](https://docs.digitalocean.com/products/managed-agents/agent-harness-runtime/concepts/approvals/index.html.md): Harness Runtime pauses an agent and requests human approval when its permission policy marks an action as ask, and you can approve, reject, or defer from the terminal or out of band.

[Secrets and Configuration](https://docs.digitalocean.com/products/managed-agents/agent-harness-runtime/concepts/secrets/index.html.md): How Harness Runtime environments carry configuration, credentials, and scoped secrets, which bind a credential to one HTTPS destination so it never enters the sandbox.

[Network Egress](https://docs.digitalocean.com/products/managed-agents/agent-harness-runtime/concepts/egress/index.html.md): A Harness Runtime sandbox reaches any host by default, and naming even one allowed host turns on an allowlist that denies everything else.