Security baseline v1.0
The control baseline we work to
Thirty two numbered controls in five domains. Each one states what it is, how it is implemented, and the evidence that proves it. We publish it because a security team should be able to argue with it before they hire us. The controls are written against the risk, not the vendor, so they apply to every AI coding agent in your estate.
Distribution
Thirty two controls, five domains
Four of the thirty two
Every control carries its evidence
| Control | Evidence handed over |
|---|---|
| The agent has its own identity, separate from any person, wherever it touches a system, issued through your identity provider with short lived credentials rather than stored keys. | Role definitions and an identity map |
| Organization wide settings are enforced and cannot be overridden locally. | Verification on three developer machines |
| Automated workflows that outside input can trigger are reviewed and gated. | A workflow audit record |
| A tested way exists to switch it off across the organization. | A kill switch drill record |
Every control maps to the OWASP Top 10 for Agentic Applications, Anthropic's published security guidance, the NIST AI Risk Management Framework and ISO/IEC 42001 control objectives, so the work lands inside the programs you already run.
What a control baseline is not
No one can certify you compliant for using AI. Certification is done by an accredited auditor. What we do is put the controls in place and hand you the evidence, so that when an auditor asks, the answer already exists. We are happy to work alongside yours.
Questions
Questions about the baseline
It is a published set of 32 security controls for AI coding agents, in five domains: identity and privilege, permissions and execution boundaries, untrusted content, connectivity and supply chain, and observability and governance. Each control states what it is, how it is implemented, and the evidence that proves it.
Every control maps to the OWASP Top 10 for Agentic Applications, Anthropic's published security guidance, the NIST AI Risk Management Framework and ISO/IEC 42001. The baseline is also aligned to the Blueprint Alliance reference architecture, so the work lands inside programs you already run.
Yes. The connectivity and supply chain domain has 5 controls covering what an agent can connect to and send data to. Connections are allowlisted, and the evidence includes your connector allowlist and egress rules.
Yes. Each control is written against a risk, such as an agent holding too much access or trusting outside input, not against one vendor. The implementation changes by platform. The control and its evidence do not.
Yes. It is published so a security team can read it, argue with it and score itself for free. What we add is the evidence, the implementation in your environment, and someone to keep it current as the tools change.