---
title: "Solving the Identity Crisis for AI Agents"
description: "Uber describes its 2025 effort to give AI agents verifiable identities and preserve attribution as agents act for users across compositional, multi-step workflows. The problem is that conventional human and workload identities expose only generic service identities, dropping originating users and intermediate agents across hops and weakening audits, authorization, and incident response. The design extends Uber’s Zero Trust Architecture with an Agent Registry, an AI Agent Mesh, Security Token Service (STS), MCP Gateway, downstream systems, and an AI Gateway, while integrating identity and context propagation into the agent SDK. Workloads obtain cryptographically signed workload SVIDs from SPIRE, and STS issues short-lived, scoped JWTs for each hop; MCP Gateway authenticates and authorizes tool calls. Production metrics reported show P99 STS token-exchange latency consistently below 40 milliseconds, while the roadmap places dynamic access control and unified policy enforcement above the identity foundation."
---

# Solving the Identity Crisis for AI Agents

[Uber](https://yomu.fyi/company/uber) · May 21, 2026

**Type:** Explainer

## Summary

Uber describes its 2025 effort to give AI agents verifiable identities and preserve attribution as agents act for users across compositional, multi-step workflows. The problem is that conventional human and workload identities expose only generic service identities, dropping originating users and intermediate agents across hops and weakening audits, authorization, and incident response. The design extends Uber’s Zero Trust Architecture with an Agent Registry, an AI Agent Mesh, Security Token Service (STS), MCP Gateway, downstream systems, and an AI Gateway, while integrating identity and context propagation into the agent SDK. Workloads obtain cryptographically signed workload SVIDs from SPIRE, and STS issues short-lived, scoped JWTs for each hop; MCP Gateway authenticates and authorizes tool calls. Production metrics reported show P99 STS token-exchange latency consistently below 40 milliseconds, while the roadmap places dynamic access control and unified policy enforcement above the identity foundation.

## Context

Uber found that agentic workflows could not reliably attribute actions to the human who initiated them because downstream systems saw generic service identities. Delegation across agents, tools, and systems dropped execution context, limiting auditing, fine-grained authorization, and incident response.

## Approach / What changed

Uber extended its Zero Trust Architecture with an Agent Registry, AI Agent Mesh, Security Token Service, MCP Gateway, and AI Gateway. The agent SDK obtains workload identity, supports end-to-end execution-context propagation, and uses short-lived, scoped JWTs minted for each agent hop.

## Takeaways

- Conventional identity models distinguish humans and workloads but do not represent an agent acting on behalf of a user or preserve that agency across delegated workflows.
- The Security Token Service issues short-lived, scoped JWTs for each hop, while MCP Gateway authenticates and authorizes calls before proxying them to downstream services.
- Reported production metrics show P99 latency for the STS Token Exchange API consistently below 40 milliseconds under current load conditions.

**Tags:** [AI Agents](https://yomu.fyi/topic/ai-agents), [Authentication](https://yomu.fyi/topic/authentication), [Kubernetes](https://yomu.fyi/topic/kubernetes), [MCP](https://yomu.fyi/topic/mcp)

- Source: [Uber](https://www.uber.com/us/en/blog/solving-the-agent-identity-crisis)
- Source URL: https://www.uber.com/us/en/blog/solving-the-agent-identity-crisis
- Ingested by Yomu: 2026-09-10T12:01:36.696Z

[Read original post](https://www.uber.com/us/en/blog/solving-the-agent-identity-crisis)