# Secure Software Factory: a reference architecture for coding agents

> Agent proposes, policy authorizes, infrastructure enforces: the paper's rule for factories where agents write the code.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Tool
- **Published by:** Agent Baseline
- **Disclosed:** 2026-10-13
- **Affects:** AI coding agents, agent orchestrators
- **Research by:** Eli Aleyner (Docker), Ranti Familusi (Docker), Allie Howe (Keycard), Ian Livingstone (Keycard), William Manning (Docker), Andy McMahon (Barclays), Ahmad Nassri (Socket), Aaron Stanley (Secure Theory)
- **Primary source:** https://agentbaseline.org/reference-architecture
- **Page:** https://theinjection.dev/items/agent-baseline-secure-software-factory/

The Secure Software Factory is a vendor-neutral reference architecture from the Agent Baseline project that puts four boundaries around AI coding agents, enforced by infrastructure the agent cannot configure or reach.

## What happened

The Agent Baseline project published version 1 of The Secure Software Factory on October 13, 2026, open for public comment. Eight authors from Docker, Keycard, Barclays, Socket and Secure Theory drafted it. Prose and figures are licensed CC BY 4.0, schemas Apache-2.0, and the source sits in the project's GitHub repository.

## How it works

The architecture treats the agent as untrusted and places limits outside its decision loop, under the principle that the agent proposes, policy authorizes and infrastructure enforces. Four boundaries, listed below, cover where agent code runs, what it can reach, which components and sources it may use, and who it acts for. Guidance is then mapped to three levels of autonomy that differ in who picks the next step, and to Agent Baseline's six security outcomes and the controls that evidence them.

## Who is affected

Teams running AI coding agents from a prompt, ticket or specification through to tested code are the audience, from a single developer-driven agent up to an orchestrator agent that chooses its own next step. At that third level the paper holds that an agent cannot grant itself access.

## What to do

Read version 1 and comment on it through the project's GitHub repository while it is open. Platform teams can use the four boundaries to check whether their own agent limits are enforced by infrastructure, or only requested in a prompt.

## Quick facts

- **Published:** October 13, 2026, version 1, open for comment
- **Drafted by:** Eight authors from Docker, Keycard, Barclays, Socket and Secure Theory
- **Boundaries:** Sandbox, network, supply chain, identity and access
- **Autonomy levels:** Human-orchestrated, workflow-orchestrated, agent-orchestrated
- **Principle:** Agent proposes, policy authorizes, infrastructure enforces
- **Licence:** CC BY 4.0 for prose and figures, Apache-2.0 for schemas

## Sources

1. [Reference Architecture](https://agentbaseline.org/reference-architecture)
2. [Source on GitHub](https://github.com/agentbaseline/agentbaseline/blob/main/software-factory/software-factory.md?plain=1)
3. [Socket Coverage](https://socket.dev/blog/agent-baseline-software-factory)