Agent Baseline provides a comprehensive framework of six security outcomes and 35 specific controls designed for the secure operation of enterprise AI agents. Unlike traditional software, AI agents are reprogrammable at runtime and possess high levels of autonomy, which necessitates specialized security measures that go beyond conventional practices. The framework helps enterprises answer critical operational questions regarding agent capabilities, boundary adherence, and the ability to audit or stop actions in real-time. By leveraging this open-source baseline, security teams and developers can implement standardized protections to manage the risks inherent in agentic workflows.

The framework functions by defining explicit security outcomes that guide the implementation of technical controls. These outcomes focus on discovery, constraint, authorization, observability, validation, and response. It emphasizes that an agent's reasoning should be decoupled from its operational permissions. The initiative also includes a reference architecture, known as the Secure Software Factory, which applies these principles specifically to agents that generate, test, and deploy code. This architecture introduces four distinct security boundaries—sandbox, network, supply chain, and identity/access—to ensure that agent actions are strictly controlled by infrastructure, regardless of the agent's internal logic.

Some of the key features are:

• Discover: Provides a mechanism to identify every agent in use, including its dependencies, owners, operating status, and current access level.
• Constrain: Implements limits on an agent's runtime environment, capabilities, data access, and available actions to ensure it stays within its intended scope.
• Authorize: Ties specific task execution to identity and clear authority, ensuring that actions are limited by purpose, resource, and time.
• Observe: Enables correlation of activities to provide verifiable evidence connecting agent intent, identity, tool use, and outcomes.
• Validate: Defines protocols for evaluating agents and their components both before deployment and after material changes.
• Respond: Outlines procedures for immediate intervention, including halting execution, revoking authority, quarantining components, and impact assessment.

Operationally, the framework is designed to be implemented by security practitioners who integrate the 35 controls into their existing software development lifecycles. Users apply the controls to their infrastructure, creating a 'policy-authorizes' and 'infrastructure-enforces' model where the agent proposes actions and the underlying systems determine if those actions comply with security policy. This allows for scalability across three levels of autonomy: human-orchestrated, workflow-orchestrated, and agent-orchestrated environments, ensuring consistent enforcement as the agent's decision-making power increases.

Some common use cases include:

• Secure CI/CD Pipelines: Implementing the Secure Software Factory architecture to prevent AI agents from executing unauthorized or malicious code changes during the software release process.
• Incident Response Automation: Utilizing the framework to allow security agents to safely access logs or triage alerts while preventing them from performing destructive actions like deleting production databases.
• Enterprise Agent Inventory: Managing an enterprise-wide registry of active AI agents to ensure visibility and accountability for all autonomous systems currently in production.
• Compliance Auditing: Using the framework's observability controls to generate irrefutable logs of agent behavior for regulatory reporting and internal policy verification.