Tushar Jain is Docker’s chief technology officer, responsible for advancing infrastructure that lets AI agents operate autonomously without gaining uncontrolled access to sensitive systems. His work applies Docker’s experience with portable software to an emerging challenge: enforcing security boundaries around agents whose plans and permissions can change while they work.
Jain joined Docker to lead engineering, bringing a background in cloud services and developer tooling. His responsibilities have ranged from responding to a Docker Hub outage to developing infrastructure for agentic applications. With Docker colleague Mark Cavage, he introduced the Docker MCP Catalog and Toolkit, bringing verified publishers, container isolation, and credential management to Model Context Protocol servers. Their subsequent work adapted Docker Compose for agentic applications, packaging agents, models, and tools into shared workflows that extend from laptops into cloud environments.
- Runtime-enforced agent safety. Jain places security controls outside the agent’s trust boundary, where models cannot override credential handling, network restrictions, or execution policies. An autonomous assistant that accidentally published a confidential analysis illustrates his central concern: overly broad permissions turn ordinary model errors into consequential actions.
- Task-scoped capabilities. An incident-response agent may need logs, repository history, and Slack conversations, but unrestricted access to all three creates an expanding security exposure. Jain advocates just-in-time MCP tools that narrow permissions to the specific assignment, potentially limiting Slack searches to incident-related conversations. Separate sandboxes can give one agent GitHub access to review a pull request and another Notion access to publish its summary.
- Intent-aware agent governance. His proposed runtime evaluates new permission requests against the user’s original objective, approving relevant access while rejecting unrelated actions or escalating them for human review. An early delegation prototype creates a narrowly permissioned subordinate sandbox when an isolated parent agent needs repository access; the broader problem remains unsolved.
- Portable isolation and secure defaults. Docker Sandboxes combine microVM isolation, injected credentials, and network policies across local execution, cloud infrastructure, and multi-agent orchestration. Jain extends the same principles to software supply-chain security, arguing that hardened images, reproducible components, provenance, and secure defaults should reduce developer workload instead of multiplying security alerts. His support for the Athena coalition and NVIDIA’s Open Secure AI Alliance extends that agenda to industry-wide security coordination.
