In a recent article, Uber Engineering highlights the limitations of traditional identity and API controls in securing AI agents that dynamically reason over external content and take real-world actions. To address this challenge, Uber developed a framework to determine whether an agent's action is appropriate given the user's request, the agent's intended purpose, its permissions, and the context of the interaction.
Identity and authorization systems can determine whether a user or service has permission to access a resource, but they can't determine whether an agent's proposed action is appropriate in context.
This creates multiple risks, including prompt injection, tool and memory poisoning, goal hijacking, behavioral drift, and hallucination-driven actions, which Uber's framework addresses through three layers spanning the entire agent lifecycle, from pre-deployment to runtime enforcement to post-deployment continuous assurance.
At provisioning time, agents must be registered in the Uber AI Registry, establishing identity, ownership, persona, permitted intents, constraints, dependencies, and risk classification. This process is automated using Argus, which analyzes the agent's source code, prompts, configurations, dependencies, exposed endpoints, and tool-invocation paths to identify security weaknesses. The same approach is enforced for MCP servers and tools used by the agents.
At runtime, the framework extends the traditional security model based on policy administration, policy decision, and policy enforcement to incorporate behavioral authorization, which evaluates whether an agent's actions are appropriate in a given context.
Behavioral authorization is implemented through three components: the AI Registry, AI guards, and Agent Guard runtime hooks. The AI Registry defines and manages agent policies, personas, intents, and constraints, while AI Guards evaluate interactions and proposed actions against established policies. Agent Guard runtime hooks invoke AI Guard "at critical checkpoints and applying its verdict before an interaction or action is allowed to proceed".
After deployment, the focus shifts to Continuous Assurance, which relies on end-to-end observability, auditing, explainability, and replay. This layer comprises two main main components: a unified execution trace that connects agent actions, tool calls, and security decisions; and recorded interactions that can be replayed whenever policies and guardrails are updated to assess their effectiveness in the new context.
Uber also identified several challenges in implementing security controls in production, including balancing policy restrictiveness to avoid both excessive false positives and insufficient protection, minimizing runtime latency, reducing developer friction during framework setup, and moving beyond generic controls towards agent-specific policies, which "made enforcement more contextual and precise".
Commenting on Uber's approach on LinkedIn, UN senior information technology officer Tristan G. raised several concerns, noting that while "per-agent personas, intents, constraints and calibration" is what adds the most value, they also come at a significant cost, as "the effort scales with the number of workflows". Additionally,
By its own account, the strongest control was restricting agents to explicit constraints, which is least privilege rather than a new idea. For me, the open question is how this works for agents you don't build, such as vendor or SaaS agents where you can't insert your own enforcement hooks.
On similar lines, AI architect Pratik Dhanave also observes that: The lesson they call least glamorous is the one they rate most effective: explicit intents and constraints per agent. Not generic thresholds, which failed because every agent has a different purpose and risk profile. The cost is flexibility, and they say it is worth paying.
Uber's Secure AI framework is still in evolving, with plans to expand its capabilities across all the areas outlined above. There is much more to the framework than can be covered here, so readers are encouraged to consult the original article for a more comprehensive overview.