--- title: The Agent Baseline: Where Should You Start? | daily.dev description: Snyk, alongside Docker and Keycard, published the Agent Baseline: six security outcomes and 35 controls for securing AI agents. This follow-up addresses the... canonical: https://daily.dev/posts/the-agent-baseline-where-should-you-start--obr1mbjvo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Agent Baseline: Where Should You Start? | daily.dev og:description: Snyk, alongside Docker and Keycard, published the Agent Baseline: six security outcomes and 35 controls for securing AI agents. This follow-up addresses the... og:url: https://daily.dev/posts/the-agent-baseline-where-should-you-start--obr1mbjvo og:image: https://api.daily.dev/og/posts/Obr1MBjvO.png og:image:alt: The Agent Baseline: Where Should You Start? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Agent Baseline: Where Should You Start? **[Snyk](https://daily.dev/sources/snyk)** · 15 min read · 1 upvotes · 0 comments ## Summary Snyk, alongside Docker and Keycard, published the Agent Baseline: six security outcomes and 35 controls for securing AI agents. This follow-up addresses the practical gap identified at a Black Hat panel — the paper is a coverage test, not a sequencing plan. It proposes prioritizing controls differently depending on use case: developer coding agents should start with Constrain (sandboxing, capability profiles) and calibrate with Discover; shared internal agents should start with Authorize to prevent confused-deputy problems; production agents should prioritize Respond (kill switches, quarantine, non-agent fallbacks) and Validate (checking outcomes, not just permissions). The piece also admits two gaps in the current Baseline draft: no maturity model and no use-case lens in v1.0. The Baseline remains open for public comment until September 30. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What security control should I implement first for a developer coding agent running on a laptop? Start with Constrain, not Discover. Isolated execution and use-case-scoped capability profiles (controls CON-03, CON-04) should be applied first, followed by a component registry for MCP servers, skills, plugins, models, and tools (DIS-04), then testing on the way out (VAL-03) since agent-generated code should pass through the same release gates as other code. _Teams sequencing AI agent security controls can track emerging guidance like this on daily.dev._ ### Why is a shared service account risky for a shared internal AI agent used by many employees? A single shared service account creates a confused deputy problem: every request enters the same access pool, so by the time a request reaches an internal API the original requester has disappeared from view, and one person's prompt can end up exercising another person's authority. The fix is a distinct verifiable identity per party, scoped delegation, attenuation down the call chain, and run correlation to answer who acted. _Developers weighing identity and authorization designs for internal agents can follow this reasoning on daily.dev._ ### What does it actually mean to stop a production AI agent during a security incident? Stopping a production agent means blocking new work, halting runs already in flight, and revoking every credential, permit, delegated grant, and session those runs created by following the delegation chain, not just the visible process. Deleting the container while leaving a token alive stops nothing. A poisoned skill file or compromised MCP server shared across many agents may also need component-level quarantine, not just host-level shutdown. _Ops and security teams building agent kill switches can track control patterns like these on daily.dev._ ## Similar posts on daily.dev - [The cookbook for safe, powerful agents](https://daily.dev/posts/the-cookbook-for-safe-powerful-agents-zgsjfvmwk) · InfoWorld · 0 upvotes · 0 comments - [The two speeds of AI agent runtime security](https://daily.dev/posts/the-two-speeds-of-ai-agent-runtime-security-opzw70ons) · Arcjet · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cloud](https://daily.dev/tags/cloud), [#ai-agents](https://daily.dev/tags/ai-agents), [#mcp](https://daily.dev/tags/mcp), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/the-agent-baseline-where-should-you-start--obr1mbjvo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Agent Baseline: Where Should You Start?","url":"https://daily.dev/posts/the-agent-baseline-where-should-you-start--obr1mbjvo","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-agent-baseline-where-should-you-start--obr1mbjvo"},"datePublished":"2026-08-12T14:26:03.741Z","dateModified":"2026-09-13T19:44:10.079Z","description":"Snyk, alongside Docker and Keycard, published the Agent Baseline: six security outcomes and 35 controls for securing AI agents. This follow-up addresses the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/691f6e4c7c3b17a1fe49de7d4ef5ca5c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/691f6e4c7c3b17a1fe49de7d4ef5ca5c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Snyk","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Snyk","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/8fb2a7b471c04bac9af29fbeb3ed1cf6","url":"https://daily.dev/sources/snyk"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-agent-baseline-where-should-you-start--obr1mbjvo","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cloud,ai-agents,mcp,appsec","timeRequired":"PT15M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Snyk","item":"https://daily.dev/sources/snyk"},{"@type":"ListItem","position":3,"name":"The Agent Baseline: Where Should You Start?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-agent-baseline-where-should-you-start--obr1mbjvo#faq","mainEntity":[{"@type":"Question","name":"What security control should I implement first for a developer coding agent running on a laptop?","acceptedAnswer":{"@type":"Answer","text":"Start with Constrain, not Discover. Isolated execution and use-case-scoped capability profiles (controls CON-03, CON-04) should be applied first, followed by a component registry for MCP servers, skills, plugins, models, and tools (DIS-04), then testing on the way out (VAL-03) since agent-generated code should pass through the same release gates as other code. Teams sequencing AI agent security controls can track emerging guidance like this on daily.dev."}},{"@type":"Question","name":"Why is a shared service account risky for a shared internal AI agent used by many employees?","acceptedAnswer":{"@type":"Answer","text":"A single shared service account creates a confused deputy problem: every request enters the same access pool, so by the time a request reaches an internal API the original requester has disappeared from view, and one person's prompt can end up exercising another person's authority. The fix is a distinct verifiable identity per party, scoped delegation, attenuation down the call chain, and run correlation to answer who acted. Developers weighing identity and authorization designs for internal agents can follow this reasoning on daily.dev."}},{"@type":"Question","name":"What does it actually mean to stop a production AI agent during a security incident?","acceptedAnswer":{"@type":"Answer","text":"Stopping a production agent means blocking new work, halting runs already in flight, and revoking every credential, permit, delegated grant, and session those runs created by following the delegation chain, not just the visible process. Deleting the container while leaving a token alive stops nothing. A poisoned skill file or compromised MCP server shared across many agents may also need component-level quarantine, not just host-level shutdown. Ops and security teams building agent kill switches can track control patterns like these on daily.dev."}}]} ```