The Secure Software Factory: the agent proposes, policy authorizes, infrastructure enforces, and passing tests don't prove it stayed in bounds
Practitioners from Docker, Keycard, Socket, Barclays and others published an open reference architecture for AI software factories. It puts four boundaries (sandbox, network, supply chain, identity and access) outside the agent, keeps them fixed across three levels of autonomy, and argues that the more an agent decides, the less it can be trusted to police itself.
Source: The Secure Software Factory: A Reference Architecture
A new open reference architecture defines a software factory as one that uses AI agents to turn a prompt, ticket or specification into tested code, and increasingly to deploy and operate it. Version 1 is dated 13 October 2026 and open for comment, drafted by authors from Docker, Keycard, Barclays, Socket and Secure Theory. Docker's announcement says it grew from teams reporting faster delivery, but also agents doing things nobody asked for, like escaping sandboxes, dropping databases and pushing to production without approval.
Boundaries outside the agent
The core rule is that the agent proposes, policy authorizes, and infrastructure enforces. Four boundaries do the enforcing: sandbox, network, supply chain, and identity and access, applied from outside its own decisions, whether it cooperates or not. The reasoning, in Docker's summary, is that the more autonomy you give an agent, the less you can rely on it to police itself, because it can be redirected at runtime by a prompt, a poisoned dependency or a malicious tool description.
Tests are a different question
For reviewers, the sharpest line is that tests are a separate check: code can pass every one and still come from an agent that reached too far. A green merge gate says the output works; it says nothing about what the agent touched to produce it. That matters most when a factory runs unattended, which is where the paper's three levels go: a developer, a predefined workflow, or an agent chooses the next step. The boundaries stay the same; what grows is the share of supervision the infrastructure takes over from people. At the top level, an agent chooses the next step, so its plans must not become its permissions.
The paper starts from real failures, like an agent that deleted a production database in nine seconds, and names the control each one lacked. Tailscale's Avery Pennarun put the same principle in plain terms: give them the authority to do a particular job, make that authority expire, and keep the policies and audit trail somewhere the agent can't rewrite them. Compare Claude Code Review reading its rules only from the base branch, another case of keeping the grading rules out of the agent's reach.