Solving the Identity Crisis for AI Agents

This post details the 2025 updates to Uber's AI agent identity and provenance system. It introduces the Agent Registry for agent registration, the AI Agent Mesh for agent communication, and the Security Token Service (STS) for minting short-lived, scoped JWTs. The MCP Gateway acts as a policy enforcement point for tool invocations, and the AI Gateway handles interactions with AI models. The system leverages SPIRE for workload SVIDs and integrates with the Michelangelo platform. Key technical contributions include the design of single-hop, short-lived tokens and the propagation of full contextual attribution (attested actor chains) across agent hops, enabling comprehensive audit logs and advanced workflow authorization.