Source: Docker Blog — 2026-08-12
Summary
Docker, working with Snyk and Keycard, published Agent Baseline — a draft v1.0 security framework of 35 controls organized into six outcomes (Discover, Constrain, Authorize, Observe, Validate, Respond) meant to give enterprises a concrete blueprint for adopting AI agents safely. The post walks through a worked attack example — a malicious ticket attachment trying to exfiltrate database data to an external address — mapping each of the six outcomes to the specific defense that would catch or contain it.
Key Takeaways
- The framework's six outcomes — Discover, Constrain, Authorize, Observe, Validate, Respond — form a full lifecycle from knowing an agent exists to responding once something goes wrong, not just a prevention checklist.
- 35 specific controls sit underneath those six outcomes in the v1.0 draft, giving each outcome concrete, checkable sub-requirements rather than staying at the level of vague principles.
- The worked example — a malicious attachment in a support ticket attempting to exfiltrate database contents to an external address — is mapped defense-by-defense to each of the six outcomes, showing exactly which control catches which step of the attack.
- Specific defenses named in the example include network policy blocking unexpected egress, short-lived scoped credentials limiting blast radius, single run-ID correlation for tracing what an agent actually did, pre-tested prompt-injection defenses, and a kill-switch paired with evidence preservation.
- Community review is open until September 30, 2026, with the framework's official launch timed to Black Hat USA 2026 — positioning it as an emerging industry-standard reference rather than a one-off Docker product feature.
Reel Script
Hook: Picture an AI agent reading a support ticket, and the ticket has a malicious attachment designed to trick it into leaking your database to an outside server. Docker just published a six-part framework mapping exactly which defenses stop that attack at every single stage.
Core Concept: As companies give AI agents real access — reading tickets, querying databases, calling internal tools — the attack surface stops being "can someone hack our server" and becomes "can someone trick our agent into doing something harmful on our behalf." That's a fundamentally different threat model, and most existing security frameworks weren't built for it. Agent Baseline organizes the response into six outcomes that cover the whole lifecycle, not just prevention: Discover, meaning you actually know which agents exist and what they can touch; Constrain, limiting what an agent is capable of doing even if compromised; Authorize, controlling what it's allowed to do in a given context; Observe, being able to see what it actually did; Validate, testing its defenses against real attack patterns before deployment; and Respond, having a way to shut it down and preserve evidence when something goes wrong.
Hands-On: The worked example is the part worth diagramming step by step: a malicious attachment lands in a support ticket, aimed at getting an agent to exfiltrate database data to an external address. Constrain is the network policy that blocks the agent's unexpected outbound connection before the data ever leaves. Authorize is the short-lived, narrowly-scoped credential that means even if the agent's session is compromised, it can't reach more than a limited slice of data. Observe is the single run-ID that ties every action in that session together, so after the fact you can trace exactly what the agent touched. Validate is having already tested this exact style of prompt-injection attack against the agent before it ever went live, rather than discovering the gap in production. And Respond is the kill-switch that cuts the agent off immediately while preserving the evidence trail for investigation. Six outcomes, one attack, one defense mapped to each stage — that's the whole framework in miniature.
Takeaway: If you're deploying agents with real tool access and don't have an answer for at least one of these six outcomes, you have a live gap, not a theoretical one — the ticket-attachment example is exactly the kind of attack already happening in the wild. Go run your own agent's access through all six categories before an incident forces the audit.