uber.comarticleSolving the Identity Crisis for AI Agents (Uber)
Uber describes how it extended its Zero Trust stack to give AI agents verifiable identities: workloads get SPIRE SVIDs, an Agent Registry validates agent-to-workload binding, and a Security Token Service mints single-hop, short-lived JWTs (based on OAuth 2.0 Token Exchange, RFC 8693) that embed the full actor chain from human to agents. An MCP Gateway enforces tool-level policy and an SDK-integrated A2A client makes secure propagation the default. It addresses delegation, provenance loss across agent hops, and auditability, and notes alignment with IETF WIMSE drafts.
TL;DR Uber's agent identity design: SPIRE-backed workload identity, STS per-hop JWT exchange carrying the actor chain, and MCP Gateway policy enforcement.
Also seen from another angle🧠 AI →
Organisations named here
- actor chain
- Agent Registry
- AI Gateway
- draft-klrc-aiagent-auth-01
- IETF WIMSE
- Michelangelo
- STS
- Uber
Technologies named here
- Agent Registry
- AI Agent Mesh
- Kubernetes
- STS
- MCP gateway
- SPIRE / SPIFFE
- Uber agent SDK
- Standardized A2A Client
- Agentgateway
- OAuth 2.0 Token Exchange
- Observability system
- Model Context Protocol
- SPIFFE
- SPIRE
- OAuth
- RFC 8693
- AI Guard
- A2A
Techniques named here
- Zero Trust Architecture extended to AI agents
- Verifiable cryptographic agent identity
Related in Identity & Access
huntress.comarticleEducation Under Attack: The Pattern Behind Recent University Breaches
huntress.comarticleNext-Gen Phishing Tactics Users Aren’t Ready For | Huntress
.png)
aikido.devwriteupGoogle API keys keep working after you delete them
