Agent Baseline — six security outcomes for enterprise AI agents

New · 13 October 2026 The Secure Software Factory: A Reference Architecture
Agents are becoming active participants in everyday workflows, with access to real data, tools and systems.
Unlike fixed-function software, an agent can be reprogrammed at runtime through natural-language instructions. It determines how to pursue a goal and takes action with limited human supervision. A mistaken or malicious instruction can therefore become a harmful action before a person can intervene.
Existing security practices remain necessary, but they were not designed for this combination of runtime programmability, access and autonomy.
That leaves three questions an enterprise has to be able to answer about any agent it runs:
Each outcome is supported by capabilities that state what a project must do, not what it might consider doing. The baseline is open source so maintainers, practitioners and security teams can inspect it, implement it, challenge it and improve it.
Browse the 35 controls behind these outcomes
It explains the risks behind the baseline and defines the capabilities, implementation requirements and evidence associated with each outcome.
Download the PDF · View the source · Share feedback
The Secure Software Factory applies Agent Baseline to agents that ship code.
Read the reference architecture · Download its PDF (the reference architecture) · Comment on it (the reference architecture)
Comment on v1.0-draft closed on 30 September 2026; what it raised is in the issues, each decided in the open. We welcome implementation feedback, uncovered control gaps, and evidence that a control is ineffective or creates disproportionate maintainer burden. See CONTRIBUTING.
Agent Baseline was drafted by Ranti Familusi Docker, Chris Huszcza Snyk, William Manning Docker, Kamil Potrec Keycard, David Schott Snyk and Jelmer Snoeck Keycard.
The Secure Software Factory: A Reference Architecture was drafted by Eli Aleyner Docker, Ranti Familusi Docker, Allie Howe Keycard, Ian Livingstone Keycard, William Manning Docker, Andy McMahon Barclays, Ahmad Nassri Socket, and Aaron Stanley Secure Theory.
Thanks to the teams who read the drafts, argued with them, and made them better.
Filing an issue is the durable way to disagree with a paper. Being in the room is the faster one.