Uber — Who's Really Behind Your AI Agent's Actions?
Note sull'episodio
When an AI agent calls another agent that changes production, who's responsible? Uber gives every agent hop its own short-lived token that records the whole chain back to a human, with P99 latency under 40 milliseconds.
Key takeaways:
- Old identity sees only the last caller. In agent-to-agent chains, a policy engine can't tell which human or agent started a request.
- Two layers of proof. SPIFFE/SPIRE verifies the workload. A separate agent identity ties the specific agent to it, so an agent can't pretend to be one it isn't allowed to host.
- Exchange tokens at every hop. Based on OAuth 2.0 Token Exchange (RFC 8693), each hop trades its token at a security token service for a new, short-lived JWT carrying the full actor chain. There's no master token to steal.
- Enforced at the gateway. An MCP gateway checks the chain before an agent touches tools or services, and the chain is traceable in observability.
- Fast and adopted. Token exchange P99 latency stays under 40 ms, and thousands of internal agents use the system.
Chapters:
00:00 A 2 a.m. outage caused by an agent
01:33 Why agents break identity
03:52 The telephone-game problem
06:11 Workload identity with SPIFFE/SPIRE
07:42 Carrying the actor chain
09:12 Token exchange at every hop
10:45 The MCP gateway
13:01 Latency and adoption
14:34 What's novel
16:05 Meta's REA and other approaches
17:37 Revocation mid-task
19:08 Limitations and next steps
21:26 Closing question
Sources:
- Solving the Identity Crisis for AI Agents (Uber Engineering, May 2026)
- RFC 8693: OAuth 2.0 Token Exchange (IETF)
Related episode: E6: Shopify — An AI Agent That Verifies Its Own Work
Enjoyed it? Follow Data Science in the Wild (one real production ML/AI system or paper per episode, hosted by Peter Liu) and rate it on Apple Podcasts or Spotify.
Also from Peter: The GenAI Evolution Atlas, Wednesday AI deep dives and Friday news roundups.
Made with AI-generated voices; curated by Peter Liu from the sources above.