Where this offering fits
Harness presents Runtime Protection Agent around API and related runtime security. Scope the actual applications, interfaces and posture questions before connecting production traffic. Runtime discovery, testing and enforcement should each have explicit acceptance criteria and authority.
Architecture and rollout decisions
Confirm supported sources, deployment mode and the permissions required. Pilot a representative API or application with approved test requests. Validate findings with engineering and decide how they enter remediation. If protection changes traffic handling, test legitimate operations and rollback separately from the ability to display findings.
An evaluation scenario for this offering
Select an approved test API with a documented endpoint list, authenticated operations and a normal client workflow. Compare the selected Runtime Protection Agent’s view with that known inventory. Add a harmless test change to an endpoint or request shape and ask engineering to review the resulting context. If enforcement is in scope, introduce only the agreed narrow rule and repeat the legitimate client task, with rollback ready. The accepted result should distinguish visible interfaces, reviewed findings and active policy. A discovery success should not be recorded as evidence that every API is protected or that blocking has been authorised.
Evidence to request for this scope
- Confirm the current agent capability and licence scope.
- Validate inventory against known application interfaces.
- Assign authority for runtime policy changes.