Secure Software Factory: a reference architecture for coding agents
Agent proposes, policy authorizes, infrastructure enforces: the paper's rule for factories where agents write the code.
· Agent Baseline · Research by Eli Aleyner (Docker), Ranti Familusi (Docker), Allie Howe (Keycard), Ian Livingstone (Keycard), William Manning (Docker), Andy McMahon (Barclays), Ahmad Nassri (Socket), Aaron Stanley (Secure Theory)
The Secure Software Factory is a vendor-neutral reference architecture from the Agent Baseline project that puts four boundaries around AI coding agents, enforced by infrastructure the agent cannot configure or reach.
01What happened
The Agent Baseline project published version 1 of The Secure Software Factory on October 13, 2026, open for public comment. Eight authors from Docker, Keycard, Barclays, Socket and Secure Theory drafted it. Prose and figures are licensed CC BY 4.0, schemas Apache-2.0, and the source sits in the project's GitHub repository.
02How it works
The architecture treats the agent as untrusted and places limits outside its decision loop, under the principle that the agent proposes, policy authorizes and infrastructure enforces. Four boundaries, listed below, cover where agent code runs, what it can reach, which components and sources it may use, and who it acts for. Guidance is then mapped to three levels of autonomy that differ in who picks the next step, and to Agent Baseline's six security outcomes and the controls that evidence them.
03Who is affected
Teams running AI coding agents from a prompt, ticket or specification through to tested code are the audience, from a single developer-driven agent up to an orchestrator agent that chooses its own next step. At that third level the paper holds that an agent cannot grant itself access.
04What to do
Read version 1 and comment on it through the project's GitHub repository while it is open. Platform teams can use the four boundaries to check whether their own agent limits are enforced by infrastructure, or only requested in a prompt.
Sources 3 links, all fetched
- 1agentbaseline.orgReference Architecture
- 2github.comSource on GitHub
- 3socket.devSocket Coverage