Agent Baseline, applied to the software factory
Reference architecture The Secure Software Factory
Subject The software factory
Version 1 · 13 October 2026
Status Open for comment A software factory uses AI agents to turn a prompt, ticket or specification into
tested code, and increasingly to deploy and operate it. This architecture keeps what an
agent decides apart from what it may do: the agent proposes, policy authorizes, and
infrastructure enforces.
Four boundaries An agent needs room to reason and try things. Four boundaries enforce what it can
actually do, from outside its own decisions, whether it cooperates or not.
1 Sandbox where its code runs 2 Network which systems and operations it can reach 3 Supply chain which components and sources it can use 4 Identity and access who the agent acts for and what it may do SANDBOX Supply chain firewall approved versions the profile allows Profile the most it can ever do Agent untrusted, no credentials Egress proxy default-deny, attaches credentials Downstream only authorized operations Everything else denied Trusted context identity, task, delegation, policy Runtime authorization service authorizes each task’s scope Approval automatic or a person Tamper-evident record grants, admissions, process starts, requests, linked by run configures at launch checks components checks packages bounds every decision proposes scope authorized scope high-impact actions 1 2 4 3 4 SANDBOX Profile the most it can ever do Supply chain firewall approved versions the profile allows Agent untrusted, no credentials Egress proxy default-deny, attaches credentials Runtime authorization service authorizes each task’s scope Trusted context identity, task, delegation, policy Approval automatic or a person Downstream only authorized operations Everything else denied Tamper-evident record grants, admissions, process starts, requests, linked by run bounds every decision configures at launch checks components checks packages proposes scope authorized scope high-impact actions 1 2 4 3 4 Take an incident agent allowed to read one service’s logs for the last hour. If it
decides it needs another service’s logs, the proxy blocks the request until a new
authorization decision grants them. Tests are a separate check: code can pass every one
and still come from an agent that reached too far.
Three levels of autonomy The three levels differ in who chooses the next step: a developer, a predefined
workflow, or an agent. The four boundaries stay the same. What grows is the share of
supervision the infrastructure takes over from people.
Select a level.
Level 1 Human-Orchestrated Level 2 Workflow-Orchestrated Level 3 Agent-Orchestrated
Level 1 Human-OrchestratedA developer chooses the next step and reviews what the agent produces.
DEVELOPER’S MACHINE or a remote environment Developer kicks off each run 4 Runtime authorization service authorizes each task’s scope authorized scope 1 SANDBOX Agent harness the coding agent, configured by its profile Skills Tools Hooks Context files inner loop, until it passes proposes scope 2 Egress proxy default- deny 4 3 Supply chain firewall approved, scanned Model gateway approved models and budgets Downstream source control, APIs, MCP servers opens Pull request reviewed by the developer OUTER LOOP the developer drives the next run and updates the configuration Observability harness logs, identity and proxy records new at Level 1 as in Figure 2 Enforced outside the agent’s loop: 1 Sandbox 2 Network 3 Supply chain 4 Identity and access Developer kicks off each run 4 Runtime authorization service authorizes each task’s scope authorized scope DEVELOPER’S MACHINE or a remote environment 1 SANDBOX Agent harness the coding agent, configured by its profile Skills Tools Hooks Context files inner loop, until it passes proposes scope 2 Egress proxy default- deny 4 Observability harness logs, identity and proxy records 3 Supply chain firewall approved, scanned Model gateway approved models and budgets Downstream source control, APIs, MCP servers opens Pull request reviewed by the developer OUTER LOOP the developer drives the next run and updates the configuration Enforced outside the agent’s loop: 1 Sandbox 2 Network 3 Supply chain 4 Identity and access new at Level 1 as in Figure 2 Figure 3 Level 1, where a developer gives an agent room to work without giving it everything the developer can reachLevel 2 Workflow-OrchestratedA predefined workflow chooses the next step, and the factory becomes a shared service.
THE FACTORY a shared service Request or an event, a schedule or a ticket Workflow predefined steps for each request schedules runs Durable execution layer CI/CD or a step runner that starts each agent 4 Runtime authorization service authorizes each task’s scope authorized scope 1 SANDBOX PER RUN Agent harness the coding agent, configured by its profile Skills Tools Hooks Context files inner loop, until it passes proposes scope 2 Egress proxy default- deny 4 3 Supply chain firewall approved, scanned Model gateway approved models and budgets Downstream source control, APIs, MCP servers opens Pull request reviewed until ready Approval automatic or a person Merge approved changes OUTER LOOP review feedback drives the next run Observability all four boundaries’ records, linked by run new at Level 2 as at Level 1 Enforced outside the agent’s loop: 1 Sandbox 2 Network 3 Supply chain 4 Identity and access Request or an event, a schedule or a ticket Workflow predefined steps for each request schedules runs Durable execution layer CI/CD or a step runner that starts each agent 4 Runtime authorization service authorizes each task’s scope authorized scope THE FACTORY a shared service 1 SANDBOX PER RUN Agent harness the coding agent, configured by its profile Skills Tools Hooks Context files inner loop, until it passes proposes scope 2 Egress proxy default- deny 4 Observability all four boundaries’ records, by run 3 Supply chain firewall approved, scanned Model gateway approved models and budgets Downstream source control, APIs, MCP servers opens Pull request reviewed until ready Approval automatic or a person Merge approved changes OUTER LOOP review feedback drives the next run Enforced outside the agent’s loop: 1 Sandbox 2 Network 3 Supply chain 4 Identity and access new at Level 2 as at Level 1 Figure 4 Level 2, where a workflow orchestratesLevel 3 Agent-OrchestratedAn agent chooses the next step, so its plans must not become its permissions.
THE FACTORY Requests people, tickets Orchestrator agent plans the work and divides it into tasks Context tickets, code, conversations schedules tasks proposes profile and task scope Durable execution layer CI/CD or a step runner that starts each agent 4 Runtime authorization service authorizes each task’s scope authorized scope each part to its own agent, with narrowed authority 1 TASK 1 Coding agent own identity, profile and task scope inner loop 2 Egress proxy default- deny 4 1 TASK 2 Coding agent own identity, profile and task scope inner loop 2 Egress proxy default- deny 4 Monitoring agent watches work in progress Monitoring agent watches work in progress Observability telemetry and evals across all runs 3 Supply chain firewall approved, scanned Model gateway approved models and budgets Downstream source control, APIs, MCP servers opens Pull request reviewed until ready Approval automatic or a person Deploy merged, can be rolled back Production emits incidents and metrics Signals incidents, scanners, monitoring, evals OUTER LOOP new work new at Level 3 as at Level 2 Enforced outside the agent’s loop: 1 Sandbox 2 Network 3 Supply chain 4 Identity and access Requests people, tickets Context tickets, code, conversations Orchestrator agent plans the work and divides it into tasks schedules tasks Durable execution layer CI/CD or a step runner that starts each agent proposes profile and task scope 4 Runtime authorization service authorizes each task’s scope authorized scope THE FACTORY each part to its own agent, with narrowed authority 1 TASK 1 SANDBOX Coding agent own identity, profile and task scope inner loop, until it passes 2 Egress proxy default- deny 4 Monitoring agent watches work in progress 1 TASK 2 SANDBOX Coding agent own identity, profile and task scope inner loop, until it passes 2 Egress proxy default- deny 4 Monitoring agent watches work in progress Observability telemetry and evals across all runs 3 Supply chain firewall approved, scanned Model gateway approved models and budgets Downstream source control, APIs, MCP servers opens Pull request reviewed until ready Approval automatic or a person Deploy merged, can be rolled back Production emits incidents and metrics Signals incidents, scanners, monitoring, evals OUTER LOOP new work Enforced outside the agent’s loop: 1 Sandbox 2 Network 3 Supply chain 4 Identity and access new at Level 3 as at Level 2 Figure 5 Level 3, where an agent orchestrates but can’t grant itself accessRead the paper The paper starts from real failures, like an agent that deleted a production
database in nine seconds, and names the control each one lacked. It then shows what to
build at each level, mapped to Agent Baseline’s controls.
Read the paper (PDF) ·
Source on GitHub ·
Share feedback
Who wrote it Drafted by Eli Aleyner Docker , Ranti Familusi Docker , Allie Howe Keycard , Ian Livingstone Keycard , William Manning Docker , Andy McMahon Barclays , Ahmad Nassri Socket , and Aaron Stanley Secure Theory .