Checking both the user and the agent
Workload identity says which software is calling; authorizing an agent's action also needs to know which user it acts for and through which chain of agents.
The idea in brief
Workload identity lets software authenticate without managing credentials. Agents add a further question: should this agent perform this action, for this user, at this point? Uber's engineering blog and an Insecure Agents podcast episode describe one large-scale answer.
How Uber describes its approach
Uber's post "Solving the Agent Identity Crisis" describes the following design:
| Concern | Approach described in the post |
|---|---|
| Proving the workload | A SPIRE-issued credential for each workload |
| Proving the agent | An agent registry linking agents to the workloads allowed to run them |
| Delegation | No reuse of the user's credentials; a new token for each hop, via a customised OAuth 2.0 Token Exchange |
| Token scope | One audience, valid for minutes |
| Provenance | An actor chain in each token: user, then each agent in turn |
| Enforcement | An MCP gateway applying tool-level policies that can check both user and agent |
| Audit | A dashboard tracing each hop with identities and allow decisions |
Sergey Burykin of Uber's AI Security team discusses the work on the Insecure Agents podcast.
The standard underneath
RFC 8693 defines OAuth 2.0 Token Exchange, a way to swap one token for another, including for delegation, where a token can represent both the subject and the party acting on its behalf. That is the general mechanism behind carrying a user's authority through a chain of services.
What carries over
- Separate proof of the workload from proof of the agent.
- Scope each token to one destination and keep it short-lived.
- Record the full chain of who is acting for whom.
- Evaluate both the user and the agent when deciding.
Limitations
Uber's setup is customised.
The post describes a tailored version of token exchange, not an off-the-shelf product.
Scale changes the design.
Patterns built for a large fleet of agents may be more than a small deployment needs.
Chains add latency.
Uber reports fast token exchange, but every hop still adds a call.
Sources
Cite this post
Adam, Ammar. (Sep 2026). Checking both the user and the agent. www.ammaradam.dev. https://www.ammaradam.dev/posts/checking-user-and-agent/.
BibTeX
@article{adam2026checkinguserandagent,
title = {Checking both the user and the agent},
author = {Adam, Ammar},
journal = {www.ammaradam.dev},
year = {2026},
month = {Sep},
url = {https://www.ammaradam.dev/posts/checking-user-and-agent/}
} 
Comments
Sign in with GitHub to like this post or join the discussion.