Source: Docker — 2026-08-12
Summary
Docker introduced "Agent Baseline" at Black Hat 2026, a governance framework defining 35 controls across six security outcomes for deploying enterprise AI agents: Discover, Constrain, Authorize, Observe, Validate, and Respond. It's open for community review through September 30, 2026. The framework's accompanying diagram maps a compromised agent run to three directions it can spread — execution/host, identity, and external network — with a specific control assigned to contain each direction.
Key Takeaways
- The six outcomes form a lifecycle, not a checklist: Discover (inventory every agent, owner, and effective access) and Constrain (limit runtime, data, tools, network, and compute to only what's needed) happen before an agent runs; Authorize gates each consequential action; Observe and Validate happen during and after; Respond is the incident-handling layer.
- Authorize is the most architecturally significant control — it binds a consequential action to a distinct identity, task, scope, and validity window, explicitly rejecting the common pattern of giving an agent one blanket, long-lived credential for everything it might ever do.
- Observe requires a stable trace ID that correlates intent, identity, policy, tool use, and outcome across an agent's entire run — without that single thread, post-incident investigation on a multi-step agent action becomes nearly impossible to reconstruct.
- Validate explicitly calls for testing agents in their real operating environment and verifying actual outputs, not just auditing the prompts fed into them — a direct rebuttal to security reviews that stop at prompt-level checks.
- The three-direction compromise model (execution/host, identity, external network) gives every one of the 35 controls a concrete failure mode it's defending against, rather than existing as an abstract best practice.
- The framework is explicitly in a public review period through September 30, 2026 — it's a draft standard soliciting community feedback, not a finished mandate yet.
Reel Script
Hook (17s)
When an AI agent gets compromised, it doesn't fail one way — it spreads in three directions at once. Docker just published a 35-control framework built specifically to contain all three, and it's open for public comment right now.
Core Concept (85s)
Here's the security problem that's specific to agents, not just regular software: a compromised web app usually has one blast radius — the server it's running on. A compromised AI agent has three, simultaneously, because an agent typically holds execution power, an identity, and network reach all at once. Docker's Agent Baseline framework maps directly to that: a compromised agent can spread through its execution environment or host — meaning it starts running code it shouldn't; through its identity — meaning it starts acting as if it's a trusted user or service it isn't; or out through the external network — meaning it starts reaching systems outside its intended scope entirely. The framework's six outcomes — Discover, Constrain, Authorize, Observe, Validate, Respond — each map to containing one or more of those three spread directions. Think of it like designing a building against fire, flood, and intrusion at the same time, instead of just picking one threat and calling the building safe.
Hands-On (75s)
The most concrete control worth understanding is Authorize. Right now, the default pattern in most agent deployments is: give the agent one API key or one service credential, and let it use that same credential for every action it ever takes. Agent Baseline says that's the wrong shape entirely. Instead, Authorize requires binding every consequential action — not the agent as a whole, the individual action — to four things: a distinct identity, the specific task it's performing, a defined scope of what it's allowed to touch, and a validity window, meaning that authorization expires. So instead of one static credential that works forever for anything, you get narrow, time-boxed, task-specific authorizations that Docker pairs with Observe — a single trace ID that ties together the agent's intent, its identity at that moment, the policy that was checked, the tool it actually called, and what happened as a result, so a security team can reconstruct the entire chain after the fact instead of piecing together fragmented logs.
Takeaway (25s)
The blanket-credential pattern is the actual vulnerability most teams are shipping right now, not some exotic prompt-injection scenario — and Authorize plus Observe is the fix worth adopting even before the full 35-control framework settles. Go read the framework and submit feedback before the September 30 review window closes.