Docker Backs Blueprint Alliance and Agent Baseline for AI Agent Security
Docker is backing two industry efforts to set shared security standards for AI agents: the Blueprint Alliance, a multi-vendor reference architecture, and Agent Baseline, a set of 35 open controls that Docker, Snyk and Keycard drafted. In a blog post, Docker argues that collaboration, not any single vendor, is the way to let companies adopt agents without losing control.
- Docker is a founding participant in the Blueprint Alliance, whose members include Okta, AWS, CrowdStrike, Google Cloud and Salesforce.
- Agent Baseline, drafted by Docker, Snyk and Keycard, defines six outcomes and 35 open, versioned controls, currently at v1.0-draft.
- Alliance members have committed to interoperability testing over MCP, OCSF, SSF and CAEP.
- Docker positions its Sandboxes, MCP Gateway and Hardened Images as covering the agent execution environment.
- Gartner expects more than 150,000 agents per average Fortune 500 enterprise by 2028, up from fewer than 15 in 2025, per Docker.
Why Docker says a shared baseline is needed
Docker's post opens with figures it attributes to Gartner and to survey data. In 2025, the average global Fortune 500 enterprise had fewer than 15 AI agents in use, and Gartner expects that to exceed 150,000 by 2028. Only 13 percent of organizations think they have the right governance for today, according to the post.
Docker says security leaders face a hard choice: allow adoption without the right controls, or block it and become an obstacle while adoption continues in the shadows. The company argues for a third option, and points to history for how to get there.
It cites the credit card industry, where brands ran separate security programs until they created PCI DSS 1.0 in December 2004 and formed the PCI Security Standards Council in 2006. It also names the Center for Internet Security, founded in 2000, and the Open Container Initiative, to which Docker contributed its image format and runC runtime in 2015. In Docker's framing, PCI mandated, CIS guided and OCI standardized, and agents will need elements of all three.
Familiar risks and new ones
Docker says agents are currently in an "everyone-builds-their-own" phase. Adoption tends to be incremental: a developer allows common commands, widens filesystem access, then connects GitHub, a cloud tool and an MCP server. The logs mostly record that the developer acted, and security is often the last to know.
Much of the risk is familiar, the post says, including shadow adoption, credential sprawl and supply chain exposure. Inventory, least privilege, audit and joiner-mover-leaver discipline still apply. Docker lists several new factors:
- Runtime reprogramming: users and agents can change what an agent does in plain language, with no release cycle.
- Borrowed identity: an agent typically assumes the user's identity, so it can read, change or delete whatever the user can.
- Autonomy: agents act asynchronously, spawn sub-agents and pass authority down the chain.
- Risky combinations: a tool with no known vulnerability can still complete a path from untrusted input to sensitive data to external communication.
- A shorter response window: containment has to revoke credentials and sessions, not only kill a process.
What the Blueprint Alliance and Agent Baseline cover
Docker is a founding participant in both initiatives, which it says start from the premise that no single vendor or enforcement point can solve the problem.
The Blueprint Alliance sets out how the pieces fit together. Okta, AWS, CrowdStrike, Databricks, Docker, Google Cloud, Lovable, Proofpoint, Salesforce, ServiceNow, Wiz and Zscaler are founding members, with GE Appliances and World Central Kitchen as strategic advisors. The open reference architecture answers four questions: where are my agents, what can they do, what are they doing, and how do I respond. Members have committed to interoperability testing over MCP, OCSF, SSF and CAEP, and to publishing reference integrations.
Agent Baseline defines what each piece must do and how to verify it. It sets six outcomes: Discover, Constrain, Authorize, Observe, Validate and Respond. It includes 35 open, versioned controls, each with a permanent identifier that can be cited in an audit finding or RFP response. The current release is v1.0-draft. Controls remain in the identity provider, the sandbox and the SIEM. Both efforts advise starting with discovery before policy, and testing the kill switch before it is needed.
Docker's role and what partners and buyers can do
Most Alliance members govern agents from the outside, Docker says, covering who the agent is, what it can reach and what it is observed doing. Docker focuses on the inside: the environment where the agent executes. The Alliance whitepaper notes that without runtime support to pause an agent without collateral impact, API-driven containment "provides a false sense of security."
Docker ties its products to the baseline. Agent Baseline's CON-03 calls for isolated, confined execution, which the company says is the job of Docker Sandboxes. Docker MCP Gateway and Docker Hardened Images cover tool access and the supply chain. The Secure Software Factory reference architecture, drafted in part by Docker authors, applies Agent Baseline to agents that ship code.
For buyers, Docker says security and platform leaders can assess against the baseline today, and that Okta offers an AI Blueprint Assessment Tool. For partners, the Alliance whitepaper assigns integrators the operating model, including assessing a customer's current stack, assigning ownership, tiering risk and running lifecycle and compliance. Technology partners get a published target to integrate against. Docker also points to its Docker Navigator Partner Program, which it says rewards AI governance work. The blueprint is available at blueprintalliance.ai and the controls at agentbaseline.org.
