Uber has published details of its internal architecture for propagating identity across multi-agent AI workflows, using an Agent Registry, Security Token Service, and MCP Gateway to issue short-lived, single-hop JWTs that carry an actor chain through each delegation step. The design is based on OAuth 2.0 Token Exchange and SPIRE workload identities, ensuring that downstream systems can evaluate both the originating human identity and the acting agent at every hop. Auth0 independently argues for the same three patterns — capability-scoped permissions, task-scoped credentials, and layered enforcement — to limit blast radius without sacrificing agent autonomy. Uber reports the system is in production across thousands of internal agents, with P99 token exchange latency under 40ms, and the company is tracking IETF WIMSE standards activity for future alignment.
