In July, Docker, Snyk, and Keycard released Agent Baseline, an open, vendor-neutral reference architecture. This framework establishes security outcomes for deploying AI agents within an enterprise setting.
This development arose from discussions with industry leaders aiming for broader agent adoption. These leaders sought answers to three key questions: "What is operating, with what capabilities?", "Is it staying inside approved boundaries?", and "Can you prove what happened and stop it?". Agent Baseline provides a shared reference for secure agent adoption by defining these security outcomes for safe organizational deployment.
Recently, the Secure Software Factory reference architecture was published. This architecture applies the security outcomes defined in Agent Baseline to a prevalent agentic workflow: the AI-powered software factory.
The Secure Software Factory was developed by practitioners from Keycard, Socket, Docker, Tessl, Tracebit, Browserbase, and Tailscale. Its design incorporated input from security leaders at large enterprises operating in regulated sectors, such as finance and insurance.
Engineering teams have increasingly constructed software factories over the past year. These systems allow agents to handle requests, modify code, execute tests, and submit results for human review. While teams report faster delivery, they also note unauthorized agent actions, including sandbox escapes, database deletions, and unapproved production pushes.
The Secure Software Factory reference architecture details how to apply Agent Baseline’s security outcomes across this workflow. It covers the entire factory process—from inputs through design, assembly, build, and verification—including controls at every stage. It also presents architectural primitives for identity and access, supply chain, network controls, runtime isolation, and orchestration.
The core concept presented is that granting an agent greater autonomy reduces reliance on its self-policing capabilities. An agent can be manipulated at runtime via a prompt, a compromised dependency, or a malicious tool description. Therefore, controls must function irrespective of the agent's decisions, necessitating their placement within the agent's execution environment. This requires boundaries around credentials, tools, dependencies, and network access, supported by evidence and human accountability.
Docker addresses this specific challenge through its container technology. Containers isolate applications, and Docker Sandboxes offer isolated MicroVMs that constrain agents deterministically. This allows coding agents to operate autonomously in isolated microVM environments, whether locally or in the cloud, with defined limits on accessible files, network destinations, and credentials. This directly supports Agent Baseline’s Constrain outcome by limiting agent reach to what the approved task demands.
Contextually, this effort reflects a broader industry realization that as agents gain more operational autonomy, the security perimeter must shift from being agent-centric to environment-centric. The involvement of multiple market participants in shaping Agent Baseline underscores a collective industry movement toward standardized, robust governance for autonomous software components.
