# The Secure Software Factory: An Open Reference Architecture > Source: > Published: 2026-10-15 19:43:02+00:00 # Reference architecture The Secure Software Factory - Subject - The software factory - Version - 1 · 13 October 2026 - Status - Open for comment A software factory uses AI agents to turn a prompt, ticket or specification into tested code, and increasingly to deploy and operate it. This architecture keeps what an agent decides apart from what it may do: the agent proposes, policy authorizes, and infrastructure enforces. ## Four boundaries An agent needs room to reason and try things. Four boundaries enforce what it can actually do, from outside its own decisions, whether it cooperates or not. 1. 1Sandbox where its code runs 2. 2Network which systems and operations it can reach 3. 3Supply chain which components and sources it can use 4. 4Identity and access who the agent acts for and what it may do Take an incident agent allowed to read one service’s logs for the last hour. If it decides it needs another service’s logs, the proxy blocks the request until a new authorization decision grants them. Tests are a separate check: code can pass every one and still come from an agent that reached too far. ## Three levels of autonomy The three levels differ in who chooses the next step: a developer, a predefined workflow, or an agent. The four boundaries stay the same. What grows is the share of supervision the infrastructure takes over from people. Select a level. ### Level 1 Human-Orchestrated A developer chooses the next step and reviews what the agent produces. ### Level 2 Workflow-Orchestrated A predefined workflow chooses the next step, and the factory becomes a shared service. ### Level 3 Agent-Orchestrated An agent chooses the next step, so its plans must not become its permissions. ## Read the paper The paper starts from real failures, like an agent that deleted a production database in nine seconds, and names the control each one lacked. It then shows what to build at each level, mapped to Agent Baseline’s controls. [Read the paper (PDF)](https://agentbaseline.org/software-factory.pdf) · [Source on GitHub](https://github.com/agentbaseline/agentbaseline/blob/main/software-factory/software-factory.md?plain=1) · [Share feedback](https://github.com/agentbaseline/agentbaseline/issues/new?template=software-factory.yml) ## Who wrote it Drafted by Eli Aleyner Docker, Ranti Familusi Docker, Allie Howe Keycard, Ian Livingstone Keycard, William Manning Docker, Andy McMahon Barclays, Ahmad Nassri Socket, and Aaron Stanley Secure Theory.