Uber Secure AI: three layers of agent security in production

#agents #ai #production #security

📅 November 7, 2026 • Uber Engineering
Uber published Secure AI, the defense-in-depth framework it uses to protect AI agents in production, in a post dated November 6, 2026. The framework has three layers: provisioning-time validation, runtime enforcement and continuous assurance. Per Uber, identity and authorization remain necessary but stop being sufficient once software reasons over untrusted content, picks tools on its own and acts on a user's behalf.

From access control to behavior control
Uber says agentic systems need a semantic layer that answers not only whether an agent may act, but whether it should act given the request, the agent's purpose and the session so far. The post names five risks that move with this shift: prompt injection, tool and memory poisoning, goal hijacking, behavioral drift and hallucination-driven actions. Instead of maintaining rules for near-infinite attack variants, Uber moved toward semantic, behavior-based enforcement.

Registry and behavioral contract
At provisioning, the Uber AI Registry holds the authoritative record of an agent's identity, ownership, persona, permitted intents, constraints, dependencies and risk tier. These properties form what Uber calls a behavioral contract. The Argus platform analyses agent source code, prompts, configurations, dependencies and tool invocation paths, so declared behavior can be compared with observed capabilities. Third-party MCP servers and tools get static and dynamic analysis, composition analysis and semantic inspection of tool descriptions.

Enforcement in the runtime
At runtime the architecture separates policy administration, policy decision and policy enforcement, extended from resources into behavior. The AI Registry acts as the policy administration point, AI Guard as the policy decision point, and Agent Guard hooks with LangFx or the AI Guard SDK as enforcement points at critical checkpoints. Per Uber, AI Guard runs small specialized models hosted locally, including models fine-tuned for individual guardrail functions, which keeps inference close to the execution path and lets each agent be calibrated.

Provenance, replay and assurance
Uber adds prompt provenance and evidence chaining so privileged actions trace back to what the user requested, plus end-to-end observability, replay of recorded interactions against candidate guardrails, threat modeling and continuous red teaming. Uber's own conclusion is that its most effective mitigation was also its least glamorous: restricting agents to explicit intents and constraints, at some cost in flexibility.