In 2025, the average global Fortune 500 enterprise had fewer than 15 AI agents in use. Gartner expects that number to explode to more than 150,000 by 2028. Only 13 percent of organizations think they have the right governance for today, and AI is evolving and moving faster than any other technology paradigm in our history.
Today, most security leaders face an agentic Sophie’s choice: allow AI adoption without the right controls and hope for the best, or block it and become the obstacle to a priority the business has already set (while adoption continues in the shadows, anyway).
But there is a third option, one in which organizations fully tap into the transformative power of agentic agents without having to live in fear of a catastrophic security failure. The good news is history has already shown how to get there.
How technology gets adopted
Historically, technology adoption has followed a reliable pattern. A capability spreads, each vendor and team builds its own approach, the inconsistency becomes expensive and ineffective, leading the industry to agree to a shared baseline. Adoption then accelerates.
Take the credit card industry, for example. The big credit brands each ran their own security programs, and merchants had to satisfy every one. This was, of course, cumbersome for the vendors, but also for the customers, too. Every time a customer wanted to adopt a new technology, they had to manually build out security and adoption plans, adding significant adoption and procurement delays.
Rather than continue on their own, the credit card companies came together to create PCI DSS 1.0 in December 2004 and formed the PCI Security Standards Council in 2006. Buyers now had one thing to ask for, and auditors had one thing to check. Collaboration overcame complexity, and everyone benefited.
Security-minded technologists can find another example closer to home in the Center for Internet Security (CIS). In the early days of the internet, cybersecurity was a veritable wild west. Enter the CIS, which was founded in 2000 because the industry lacked prescriptive, recognized hardening standards. To this day, each CIS Benchmark is built by consensus among volunteer experts, vendors, and academics.
Docker itself is no stranger to the development and furthering of shared standards. As just one example, in 2015, Docker contributed its image format and runC runtime to the Open Container Initiative. A shared baseline at the runtime layer let registries, runtimes, and clouds interoperate.
Each of these examples played a different role: PCI mandated, CIS guided, and OCI standardized.
Agents will need elements of all three.
Where enterprise AI is on that curve
Agents are in the everyone-builds-their-own phase. Each product solves a real piece of the problem, but which piece, and how the pieces fit, is rarely clear. “Agent governance” or even “AI governance” can mean almost anything.
Adoption is incremental. A developer allows common commands, widens filesystem access, then connects GitHub, a cloud tool and an MCP server, each through a prompt that makes sense on its own. The logs mostly record that the developer acted. Security is often the last to know.
The risks: familiar and new
Much of the risk is familiar. Shadow adoption looks a lot like early SaaS and cloud. Credential sprawl and supply chain exposure are old problems. Inventory, least privilege, audit, and joiner-mover-leaver discipline still apply.
Several things are new, however:
- Runtime reprogramming. Users — and the agents themselves — can change what an agent does in plain language, with no release cycle.
- Borrowed identity. An agent typically assumes the user’s identity, so anything the user can read, change, or delete, the agent can too.
- Autonomy. Agents act asynchronously, spawn sub-agents, and pass authority down the chain. A bad instruction can become an action before anyone steps in.
- Risky combinations. A tool with no known vulnerability can still complete a path from untrusted input to sensitive data to external communication.
- A shorter response window. Containment has to revoke credentials and sessions, not only kill a process.
Existing controls still matter, but they were not built for this mix of programmability, access, and autonomy.
How the Blueprint Alliance and Agent Baseline respond
As with the credit industry and PCI, cybersecurity and the CIS, and containerization and OCI, collaboration offers the answer to this new era of complexity. That’s why Docker is not just focused on building tools like Docker Sandboxes and Docker AI Governance, but in taking an ecosystem-centric approach to problem solving for our customers. Docker is already a founding participant in multiple initiatives aimed at developing valuable reference architectures for AI security workflows, including the Blueprint Alliance and Agent Baseline.
Both start from the same premise: no single vendor or enforcement point can solve this.
The Blueprint Alliance sets out how the pieces fit together. Okta, AWS, CrowdStrike, Databricks, Docker, Google Cloud, Lovable, Proofpoint, Salesforce, ServiceNow, Wiz and Zscaler are founding members, with GE Appliances and World Central Kitchen as strategic advisors. The open, multi-vendor reference architecture answers four questions: Where are my agents? What can they do? What are they doing? How do I respond? Members have committed to interoperability testing over MCP, OCSF, SSF and CAEP, and to publishing reference integrations.
Agent Baseline sets out what each piece must do and how to verify it. It fills the gap between threat lists, which say what can go wrong, and the capabilities an enterprise needs in place. It defines six outcomes (Discover, Constrain, Authorize, Observe, Validate and Respond) and 35 open, versioned controls, each with a permanent identifier you can cite in an audit finding or RFP response. Docker, Snyk and Keycard drafted it, and the current release is v1.0-draft. Controls stay where they already live, in the identity provider, the sandbox and the SIEM.
Blueprint says how the pieces connect. Agent Baseline says what must be true and can be checked. Both advise starting with discovery before policy, and testing the kill switch before you need it.
For partners, the roles are defined. The Alliance whitepaper assigns integrators the operating model: assessing a customer’s current stack against the architecture, assigning ownership across the pillars, tiering risk, and running lifecycle and compliance over time. Technology partners get a published target to integrate against, and the reference integrations cross vendor lines by design. The partners who can design, integrate and operate across those lines are the ones customers keep.
Where Docker fits
Most Alliance members govern agents from the outside: who the agent is, what it can reach, and what it is observed doing. Docker governs the inside: the environment where the agent executes. As agents move from suggesting actions to taking them, trust has to extend beyond the model to the places where they run. Docker has helped define a shared baseline for the runtime before, and now we’re working with the Alliance and our partners to make that baseline concrete, open, and testable in the age of agents.
The execution environment is where policy gets enforced and evidence gets produced.
That boundary is where policy gets enforced and evidence gets produced. The Alliance whitepaper notes that without runtime support to pause an agent without collateral impact, API-driven containment “provides a false sense of security.” Agent Baseline’s CON-03 calls for isolated, confined execution, which is the job of Docker Sandboxes, while Docker MCP Gateway and Docker Hardened Images cover tool access and the supply chain.The Secure Software Factory reference architecture, drafted in part by Docker authors, applies Agent Baseline to agents that ship code.
What to do next
Baselines let adoption move faster, not slower. Security and platform leaders can assess against the baseline today. Agent Baseline controls are citable, and Okta offers an AI Blueprint Assessment Tool. Partners can start with the Docker Navigator Partner Program, which rewards AI governance work, and with the reference integrations the Alliance publishes. Docker’s VP of Partners Leon Jones explains the program here. Download the blueprint at blueprintalliance.ai and read the controls at agentbaseline.org.