Agent Baseline

  • Identify the agent.
  • Bound its authority.
  • Control its actions.
  • Prove its outcomes.

Agents are becoming active participants in everyday workflows, with access to real data, tools and systems.

Unlike fixed-function software, an agent can be reprogrammed at runtime through natural-language instructions. It determines how to pursue a goal and takes action with limited human supervision. A mistaken or malicious instruction can therefore become a harmful action before a person can intervene.

Existing security practices remain necessary, but they were not designed for this combination of runtime programmability, access and autonomy.

That leaves three questions an enterprise has to be able to answer about any agent it runs:

  1. What is operating, with what capabilities? DiscoverConstrain
  2. Is it staying inside approved boundaries? AuthorizeValidate
  3. Can you prove what happened and stop it? ObserveRespond

Each outcome is supported by capabilities that state what a project must do, not what it might consider doing. The baseline is open source so maintainers, practitioners and security teams can inspect it, implement it, challenge it and improve it.

The six outcomes

  1. DiscoverDIS-01…07 Discover every agent and its dependencies.Maintain an accurate view of the agents in use, their components, owners, operating status and effective access.
  2. ConstrainCON-01…07 Limit components, runtime, data and reach.Limit each agent and component to the environments, capabilities, data and actions its approved purpose requires.
  3. AuthorizeAUT-01…06 Bind identity, task, target and authority.Attribute consequential actions, and limit authority by purpose, task, resource, action and time.
  4. ValidateVAL-01…05 Admit the system and verify outcomes.Evaluate agents and their components before use, after material changes, and at intervals appropriate to their risk.
  5. ObserveOBS-01…04 Correlate activity and prove what happened.Create correlated evidence connecting intent, identity, task, policy, tool use, action and outcome.
  6. RespondRES-01…04 Stop, revoke, quarantine and scope impact.Stop execution, remove active authority, quarantine affected components, preserve evidence and determine impact.

Browse the 33 controls behind these outcomes

Read the white paper

It explains the risks behind the baseline and defines the capabilities, implementation requirements and evidence associated with each outcome.

Download the PDF · View the source · Share feedback

Working draft for community review

Open for comment until 30 September 2026. The current structure reflects our experience so far. We welcome implementation feedback, uncovered control gaps, and evidence that a control is ineffective or creates disproportionate maintainer burden. See CONTRIBUTING.

Who wrote it

Drafted by Ranti Familusi (Docker), Chris Huszcza (Snyk), William Manning (Docker), Kamil Potrec (Keycard), David Schott (Snyk) and Jelmer Snoeck (Keycard).