The Secure Software Factory: A Reference Architecture — Agent Baseline

Agent Baseline, applied to the software factory
The Secure Software Factory
A software factory uses AI agents to turn a prompt, ticket or specification into tested code, and increasingly to deploy and operate it. This architecture keeps what an agent decides apart from what it may do: the agent proposes, policy authorizes, and infrastructure enforces.
An agent needs room to reason and try things. Four boundaries enforce what it can actually do, from outside its own decisions, whether it cooperates or not.
Take an incident agent allowed to read one service’s logs for the last hour. If it decides it needs another service’s logs, the proxy blocks the request until a new authorization decision grants them. Tests are a separate check: code can pass every one and still come from an agent that reached too far.
The three levels differ in who chooses the next step: a developer, a predefined workflow, or an agent. The four boundaries stay the same. What grows is the share of supervision the infrastructure takes over from people.
A developer chooses the next step and reviews what the agent produces.
A predefined workflow chooses the next step, and the factory becomes a shared service.
An agent chooses the next step, so its plans must not become its permissions.
The paper starts from real failures, like an agent that deleted a production database in nine seconds, and names the control each one lacked. It then shows what to build at each level, mapped to Agent Baseline’s controls.
Read the paper (PDF) · Source on GitHub · Share feedback
Drafted by Eli Aleyner Docker, Ranti Familusi Docker, Allie Howe Keycard, Ian Livingstone Keycard, William Manning Docker, Andy McMahon Barclays, Ahmad Nassri Socket, and Aaron Stanley Secure Theory.