Docker, Snyk and Keycard have published a shared rulebook for running AI agents inside companies. According to Docker’s announcement, the group’s Agent Baseline v1.0-draft defines 35 controls grouped into six security outcomes, was released on July 30, 2026, presented at Black Hat USA 2026, and stays open for community review until September 30, 2026.
The problem the group is aiming at is mundane and hard to patch. A support agent reads a ticket, the attachment hides an instruction to dump the customer database to an outside address, and the agent already holds every permission needed to comply. Docker’s argument is that the fix cannot be better model judgment; it has to be the systems around the model deciding what the agent can reach and what authority it can spend.
Six outcomes, 35 controls
The six outcomes named by Docker are Discover, Constrain, Authorize, Observe, Validate and Respond. Discover keeps an accurate record of each agent, its owner, its components and its effective access. Constrain limits runtime, data, tools, network reach, compute and duration. Authorize ties consequential actions to a specific identity, task, target, scope and validity window. Observe links intent, policy decisions and outcomes under one run or trace ID. Validate tests the agent in the configuration it will actually run in. Respond covers stopping the agent, revoking authority, quarantining components and preserving evidence.
The published control list on agentbaseline.org shows how granular this gets. Discover alone runs from DIS-01, an authoritative agent registry with a stable identifier, through DIS-06 effective-access mapping and DIS-07 automated reconciliation against source, cloud, endpoint, identity, SaaS, gateway and runtime evidence. Constrain opens with admission enforcement that blocks deployment of an unregistered or unapproved component, then CON-02 targets “toxic capability combinations” such as the lethal trifecta, and CON-03 requires agent-controlled code to run inside a boundary separated from the host, unrelated projects and credentials, per the same control list.
Why the gap is usually integration, not tooling
According to Docker, most teams already operate three or four of these controls, and the failure is that they do not connect, so a block fires in one place while the evidence lands somewhere else. Docker states that claim about its customers; it is not an independent survey. Identity management, network policy, workload isolation, logging and incident response all predate agents. What changes is that a runtime-programmable actor can be redirected by plain language mid-task, delegate to sub-agents, and move across systems faster than a human reviewer can follow.
That framing also explains the shape of Docker’s own products. Docker Sandboxes run agents in microVMs, Docker AI Governance offers a central control layer, and the MCP Gateway documentation describes running MCP servers in isolated containers with restricted privileges, network access and resource usage, plus call tracing — with the Gateway included in Docker AI Governance as an invite-only feature. The baseline is vendor-neutral text; the implementations around it are not, and readers evaluating it should keep those two things separate.
What to do with it this quarter
The draft is most useful right now as an audit checklist rather than a compliance target. Pick one agent already in production, then try to answer the three questions Docker poses: what is operating and what can it do, is it inside approved boundaries, and can you prove what happened and stop it. Teams that stall on the first question usually lack a component registry, not a security product. Teams that stall on the third usually have logs that never share a run ID.
Docker is explicitly asking for implementation feedback during the review window, including evidence that a control does not work and cases where a requirement imposes disproportionate operational burden, per the announcement. That is the more interesting invitation. A control set written mostly by vendors gets better only if operators push back with what broke in production.
For more on how Docker has been arguing this case, see our earlier report on Docker’s case for agentic AI guardrails, not guesswork, and on the training side of enterprise rollouts, OpenAI Academy’s three new enterprise AI courses.
