Agent Baseline

  • Identify the agent.
  • Bound its authority.
  • Control its actions.
  • Prove its outcomes.

New · 13 October 2026 The Secure Software Factory: A Reference Architecture

Agents are becoming active participants in everyday workflows, with access to real data, tools and systems.

Unlike fixed-function software, an agent can be reprogrammed at runtime through natural-language instructions. It determines how to pursue a goal and takes action with limited human supervision. A mistaken or malicious instruction can therefore become a harmful action before a person can intervene.

Existing security practices remain necessary, but they were not designed for this combination of runtime programmability, access and autonomy.

That leaves three questions an enterprise has to be able to answer about any agent it runs:

  1. What is operating, with what capabilities? DiscoverConstrain
  2. Is it staying inside approved boundaries? AuthorizeValidate
  3. Can you prove what happened and stop it? ObserveRespond

Each outcome is supported by capabilities that state what a project must do, not what it might consider doing. The baseline is open source so maintainers, practitioners and security teams can inspect it, implement it, challenge it and improve it.

The six outcomes

  1. DiscoverDIS-01…07 Discover every agent and its dependencies.Maintain an accurate view of the agents in use, their components, owners, operating status and effective access.
  2. ConstrainCON-01…04 Limit components, runtime, data and reach.Limit each agent and component to the environments, capabilities, data and actions its approved purpose requires.
  3. AuthorizeAUT-01…09 Bind identity, task, target and authority.Attribute consequential actions, and limit authority by purpose, task, resource, action and time.
  4. ObserveOBS-01…06 Correlate activity and prove what happened.Create correlated evidence connecting intent, identity, task, policy, tool use, action and outcome.
  5. ValidateVAL-01…04 Admit the system and verify outcomes.Evaluate agents and their components before use, after material changes, and at intervals appropriate to their risk.
  6. RespondRES-01…05 Stop, revoke, quarantine and scope impact.Stop execution, remove active authority, quarantine affected components, preserve evidence and determine impact.

Browse the 35 controls behind these outcomes

Read the white paper

It explains the risks behind the baseline and defines the capabilities, implementation requirements and evidence associated with each outcome.

Download the PDF · View the source · Share feedback

Built on the baseline

The Secure Software Factory applies Agent Baseline to agents that ship code.

Read the reference architecture · Download its PDF (the reference architecture) · Comment on it (the reference architecture)

Working draft for community review

Join the Slack

Comment on v1.0-draft closed on 30 September 2026; what it raised is in the issues, each decided in the open. We welcome implementation feedback, uncovered control gaps, and evidence that a control is ineffective or creates disproportionate maintainer burden. See CONTRIBUTING.

Who wrote it

Agent Baseline was drafted by Ranti Familusi Docker, Chris Huszcza Snyk, William Manning Docker, Kamil Potrec Keycard, David Schott Snyk and Jelmer Snoeck Keycard.

The Secure Software Factory: A Reference Architecture was drafted by Eli Aleyner Docker, Ranti Familusi Docker, Allie Howe Keycard, Ian Livingstone Keycard, William Manning Docker, Andy McMahon Barclays, Ahmad Nassri Socket, and Aaron Stanley Secure Theory.

With thanks

Thanks to the teams who read the drafts, argued with them, and made them better.