Docker has published Agent Baseline, a new blueprint aimed at bringing enterprise-grade security to AI agent deployments. As organizations increasingly adopt agentic AI systems, the risks of prompt injection, data exfiltration, and unauthorized actions grow. The framework outlines six security outcomes to address these challenges, providing a clear path for developers and security teams to collaborate.
- Outcome 1: Identity and Access Control – Every agent must have a distinct identity, tied to a human owner, with least-privilege permissions. Use
OIDCand short-lived tokens instead of static secrets. - Outcome 2: Data Isolation – Agents must operate within isolated environments, such as Docker containers or sandboxes, to prevent cross-tenant data leakage. Leverage
--network noneor private networks for sensitive tasks. - Outcome 3: Activity Logging – All agent actions must be logged for auditability. Integrate with
docker logsand structured logging to capture decisions and data flows. - Outcome 4: Human Approval – Critical actions require human sign-off via APIs like
POST /approveor policy hooks, ensuring no irreversible changes happen autonomously. - Outcome 5: Input Validation – Agents must validate and sanitize all inputs to mitigate prompt injection. Use tools like
jsonschemaor custom validators to filter malicious instructions. - Outcome 6: Explicit Boundaries – Define clear operation limits (e.g., no external network access) via policy-as-code, such as
OPAorSPIFFE-based attestation.
These outcomes are not theoretical; Docker emphasizes practical implementation. For example, a customer-support agent receiving a malicious attachment with hidden instructions to query a database and exfiltrate data would be blocked by the combination of data isolation (no network access) and input validation (attachment parsing in a sandbox).
For developers, this baseline bridges the gap between building smart agents and deploying them responsibly. It shifts the focus from reactive security to proactive design patterns. By adopting these outcomes early, you can avoid costly rework and earn trust with your enterprise customers. Docker positions this as a community-driven effort, encouraging feedback and contributions to evolve the baseline.
Source: https://www.docker.com/blog/a-new-security-baseline-for-enterprise-agentic-adoption/