Research Index: Every Source Behind This Handbook, Annotated
Sixty-three research files sit behind this handbook, plus two primary-source PDFs (the NIST NCCoE agent-identity concept paper and the 57-page OWASP Agentic Top 10). Of the 63, 47 are downloads of published sources, converted to markdown with full-text or condensed fidelity noted at capture. The other 16 are original handbook research with no external URL: four community-findings sweeps, seven deep dives and verification files, and five synthesis files.
Each entry names the source, links the canonical published URL, and states in one line what it contributes, so any claim on any page can be checked at its root. Entries marked handbook research have no external URL; for those, the verdict is the entry.
The three reports the whole handbook builds on
Covered in depth in the source reports.
Compliance and governance: the standards bodies all moved in 2026
| Source | What it gives this handbook |
|---|
| AIUC-1: the AI agent standard | The assurance standard Intercom certified against: six risk categories and a named control taxonomy (verified current June 2026) |
| AIUC-1 Q2-2026 standard update | The April 15, 2026 release in sub-control detail: MCP runtime containment (B006.3), agent-to-agent message signing (B008.4), JIT per-subtask credentials (A003.4); quarterly release cadence |
| Schellman: What to Expect in the ISO 42001 Certification Process | What an AIMS audit actually inspects: Stage 1 / Stage 2 and the surveillance cycle, from the firm that audited Intercom |
| NIST: AI Agent Standards Initiative | The February 17, 2026 announcement: three pillars, candidate standards including MCP, OAuth 2.1, and SPIFFE/SPIRE; the companion NCCoE concept paper targets identity binding, non-repudiation, tamper-proof logging |
| Cloud Security Alliance: The Agentic Trust Framework | Five Zero Trust questions and an Intern-to-Principal agent maturity model with promotion gates; SOC 2, ISO 27001, and EU AI Act mappings |
| Microsoft: What is Microsoft Entra Agent ID? | Agent identities as first-class directory objects: blueprints, third-party federation, Conditional Access for agents (post-GA, April 2026) |
| Gravitee: The State of AI Agent Security 2026 | Primary source for the 21.9% agents-managed-as-identities figure (900+ respondents); 57.4% of builders cite insufficient logging |
| NIST: AI Risk Management Framework | AI RMF 1.0 plus the Generative AI Profile (AI 600-1) |
| Vanta: Millions of AI agents lack oversight | Shadow-AI sprawl data: 70% of companies have unprocured AI touching their environment |
| Auditor FAQ corpus (handbook research) | 22 canonical auditor questions about AI agents, deduplicated from ~60 instances across Schellman, A-LIGN, ISACA, IAPP, and Big 4 material; audit trail dominates, isolation is least-asked, and five question clusters map to no property |
| AI liability and insurance (handbook research) | Who pays when agent code fails: vendor copyright indemnities are mature, everything else defaults to the deployer; AIUC's insurance-backed certification; EU Product Liability Directive strict liability from December 2026 |
Security and sandboxing: the trifecta and the controls that hold
| Source | What it gives this handbook |
|---|
| Simon Willison: The lethal trifecta for AI agents | The organizing frame: private data, untrusted content, and external communication must never coexist |
| OWASP: Top 10 for LLM Applications 2025 | All ten risk pages in full, LLM01 Prompt Injection through LLM06 Excessive Agency and beyond |
| OWASP: Top 10 for Agentic Applications 2026 | ASI01–ASI10 (December 2025), with an incidents tracker and an AIUC-1 crosswalk |
| Anthropic: Claude Code sandboxing | Filesystem and network isolation, proxy-based domain allowlisting, 84% fewer permission prompts, open-source sandbox-runtime |
| Anthropic: Code execution with MCP | Replacing direct MCP tool calls with sandboxed code execution; token-cost and privacy analysis |
| Fly.io: Agent Sandboxes | Sandbox architecture for agents: microVM vs container isolation, observability, ephemeral vs persistent |
| Kubernetes: Running Agents with Agent Sandbox | The Agent Sandbox CRD (agents.x-k8s.io/v1beta1): gVisor/Kata isolation, WarmPool (announced March 2026) |
| Dependency provenance controls (handbook research) | The SLSA, sigstore, and trusted-publishing landscape; verdict: vendors gate the registry host, never the package; drafts the seventh property's control text both ways |
Cloud agent platforms: what six vendors document
These six feed the platform comparison matrix.
| Source | What it gives this handbook |
|---|
| OpenAI: Codex cloud | Per-task containers, secrets stripped before the agent phase, proxy-only egress |
| Google: Jules | Async agent on per-task GCP VMs; plan-before-execute review model |
| Google: Managed Agents API (I/O 2026) | The Antigravity harness as agent-as-a-service in the Gemini Enterprise Agent Platform, with per-agent ephemeral sandboxes |
| GitHub: Copilot cloud agent | The richest compliance material in the field: Copilot-authored signed commits with the requester as co-author, requester-can't-approve-own-PR, 59-minute session cap |
| Cursor: Cloud Agents | HSM-signed commits, secret redaction, lockable egress modes; auto-runs all commands with internet on by default |
| Cognition: Don't Build Multi-Agents | The counterpoint essay: share full traces, prefer single-threaded agents over parallel subagents |
In-house platforms: five companies converged on the same architecture
The convergence is argued in in-house convergence.
| Source | What it gives this handbook |
|---|
| Stripe: Minions: one-shot, end-to-end coding agents | 1,300+ merged PRs/week on Devboxes; QA-isolated so agents never act "with a human's personal credentials"; the human opens the PR |
| Ramp: Why We Built Our Own Background Agent | ~30% of merged PRs; PRs opened with the requesting user's token to prevent self-approval: the corpus's best practitioner statement of attribution plus segregation of duties |
| Spotify: 1,500+ PRs Later: Honk, Part 1 | Fleet Management plus agents, 1,500+ merged PRs; logs to GCP, traces in MLflow; "we don't have all the answers yet" on sandboxing |
| Shopify: Under the River | River coauthors 1 in 8 merged PRs on Aquifer, an in-house agent substrate: durable Postgres session log, harness outside the sandbox, Nix-reproducible profiles; the clearest public match to the reference architecture |
| Uber: uReview | 4-stage GenAI review on 90% of ~65K weekly diffs; 65% of its comments addressed vs 51% for human reviewers' |
| Instacart: AI-Driven Development at Instacart | The adoption and enablement story (Tomato, Fizz); conspicuously silent on attribution, audit, and gates |
| Coinbase agent councils (handbook research) | Verification verdict: partially substantiated. Auto-merge is real but risk-scoped to copy and minor fixes; the "95%+ better than human" council claim rests on one secondhand X article, and LangChain's link miscites it |
| LangChain: Open SWE | Open-source codification of the convergent architecture; approval gates ship as optional middleware |
Evidence and outcomes: the numbers cut both ways
| Source | What it gives this handbook |
|---|
| Gartner: Magic Quadrant for Enterprise AI Coding Agents (licensed; may be gated) | May 20, 2026: Leaders are Anthropic, Cursor, GitHub, OpenAI; net average AI productivity gain 19.3% (n=482 leaders); Claude Code >$2.5B run-rate |
| Google Cloud: the 2025 DORA Report | 90% use AI, yet adoption remains negatively related to delivery stability (public summary; full PDF gated) |
| METR: Early-2025 developer productivity RCT | Experienced open-source developers were 19% slower with AI while believing they were faster |
| METR: experiment redesign and May 2026 usage survey | The follow-ups: a −18% point estimate METR itself declares unreliable (cite the trajectory, not a number), and a self-report survey with median 1.4–2x perceived value, likely overstated |
| Google Research: AI in software engineering at Google | 37% completion acceptance; AI completes 50% of code characters internally |
| Meta: TestGen-LLM (arXiv) | 75% of generated tests build, 57% pass, 73% of recommended ones accepted; abstract only, no arXiv HTML for this paper |
Incidents: six named failures, each with a primary source
The seventh casebook entry, Moonwell, is community-sourced and lives in the community re-sweep below, not as a standalone incident file. These six are read together in the incident record and analyzed one by one in the casebook inside Build the Environment, where each incident motivates a piece of the environment design.
Human takeover: the thinnest shelf in the corpus
The shelf is thin because the field is: vendors shipped takeover buttons, nobody published takeover architecture. This is the evidence base for the four-transfer standard.
| Source | What it gives this handbook |
|---|
| Human takeover literature sweep (handbook research) | The verdict above, plus a vendor table of what actually transfers (branch, environment, conversation, process state): no product transfers all four |
| Maggie Appleton / GitHub Next: One Developer, Two Dozen Agents, Zero Alignment | Ace, the multiplayer coding workspace (April 2026): the only teammate-takeover work found |
| Eric Horvitz: Principles of Mixed-Initiative User Interfaces (CHI '99) | The twelve mixed-initiative principles verbatim, the unapplied HCI ancestor; principles 6, 7, 9, and 11 map onto takeover trigger, kill-and-restart, human completion, and state transfer |
| AgentBay (arXiv 2512.04367) | The empirical case for takeover: Agent+Human intervention yields >48% relative success-rate improvement |
| CLEO: concurrent human-agent interaction (arXiv 2603.02050) | The reverse seam: concurrent human action in 31.8% of turns, and agents cannot distinguish feedback from parallel work, which is also an attribution problem |
Developer transparency: the audit trail is also a monitoring system
| Source | What it gives this handbook |
|---|
| Developer surveillance and transparency (handbook research) | Every vendor ships full prompt capture as an invisible employer opt-in; includes a vendor admin-visibility table; the proposed reconciliation is tiered, disclosed, self-auditing query access |
| Works-council AI agreements (handbook research) | Actual German Betriebsvereinbarung templates in full text (HUMAINE, IG Metall NRW, Bitkom, IBM/ver.di): an 8-category clause architecture and HUMAINE §10's unwind-the-firing remedy; no AI-agent-specific template exists yet |
Community voices: four raw-findings sweeps (handbook research)
All four are verbatim quotes with permalinks, not polished prose, and none has a single canonical URL.
| Sweep | What it found |
|---|
| Reddit voices, June 2024 – May 2025 | 42 hits across 8 themes; personas, vocabulary, permalinks (via the PullPush archive) |
| Reddit re-sweep, June 2025 – June 2026 | 38 hits via Arctic Shift; "co-authored-by claude" went from zero to a three-front fight; the Moonwell $2M hack attributed via a Claude co-authored commit; approval fatigue named as the --dangerously-skip-permissions driver |
| Hacker News, through June 2026 | Thread-by-thread mining of discussions of the three reports and organic threads; 7 persona profiles and a community vocabulary list |
| Question venues, through June 2026 | The venue map beyond Reddit and HN: vendor forums, auditor FAQs, conferences, gated communities, and where each persona actually asks |
Synthesis files: the five verdicts (handbook research)
These are original analysis written against the corpus above. Each is one verdict.
| File | The verdict |
|---|
| Framework mapping | Control-by-control across SOC 2, ISO 27001/42001, AIUC-1, HIPAA, GDPR, and NIST AI RMF: the seven properties cover the technical controls and none of the organizational ones |
| Platform comparison | No shipping platform documents the full property set; Copilot comes closest with two full checks; the whole field is silent on residency and audit-query APIs |
| Failure modes | The incident-by-trifecta-by-property table: credential isolation is the control that wins where prompt-level defenses lose, and slopsquatting is why dependency provenance became the seventh property |
| Industry approaches | A five-category taxonomy (laptop, CI-native, vendor cloud, in-house platform, managed substrate) across 40+ linked sources; five companies independently converged on the reference architecture |
| Audience personas | Seven personas with verbatim quotes and venue maps; every source converges on "prompt-level governance fails, environment-level controls hold" |
What the corpus does not contain
The gaps: there is no public primary source for Coinbase's "agent councils" beyond one secondhand X article, the full DORA 2025 PDF and the Gartner Magic Quadrant are gated, the Meta TestGen-LLM paper is captured as abstract only, and no AI-agent-specific works-council template exists anywhere yet. Where a handbook page leans on any of these, the page says so.
