Agentic AI could sit inside 33% of enterprise software applications by 2028, up from roughly 1% today (Source: Gartner via AI Business, 2024). In the Philippines, the National Privacy Commission already holds organizations accountable for the outcomes of AI processing and requires mechanisms for people to contest automated decisions (Source: National Privacy Commission, 2024). The gap between those two facts is architectural: plenty of teams can deploy an agent, and few can prove which agent acted, on whose behalf, and under what scope.

Infographic

Authorization Answers Who, Not Whether

Uber's security team states the problem plainly: identity and authorization systems can determine whether a user or service has permission to access a resource, but they cannot determine whether an agent's proposed action is appropriate in context (Source: Uber, 2026). The failure modes that follow are semantic rather than credential-based: prompt injection, tool and memory poisoning, goal hijacking, behavioral drift, and hallucination-driven actions (Source: Uber, 2026).

Gartner describes the same shift: with agents, the threat surface expands to the chain of events the agent initiates, which by default are not visible to and cannot be stopped by human or system operators (Source: Gartner via AI Business, 2024).

A control you cannot see is a control you cannot pull. Gartner now expects 25% of enterprise generative AI applications to hit at least five minor security incidents a year by 2028 (Source: Gartner, 2026).

Three Layers Spanning the Whole Lifecycle

Uber's Secure AI framework covers the agent lifecycle in three layers: provisioning-time validation, runtime enforcement, and continuous assurance (Source: Uber, 2026).

At provisioning, the Uber AI Registry stores an agent's identity, ownership, persona, permitted intents, constraints, dependencies, and risk tier. Argus reads source code, prompts, configurations, dependencies, exposed endpoints, and tool-invocation paths to derive intents that the declared contract can be checked against (Source: Uber, 2026).

At runtime the registry is the policy administration point, AI Guard the decision point, and Agent Guard hooks the enforcement points. An agent can hold valid credentials and the user legitimate access, and the action can still be denied as outside the agent's defined intent (Source: Uber, 2026).

The third layer closes the loop: a unified execution trace links actions, tool calls, and guardrail decisions, recorded interactions replay against candidate guardrails before enforcement, and automated threat modeling with red teaming feeds findings back into risk scores (Source: Uber, 2026).

Identity That Survives Every Hop

The identity layer is where most stacks fail. Uber's engineers found that identity models are built around humans and workloads, while the originating user and intermediate agents are dropped across hops, leaving downstream systems to see only that some service called an API (Source: Uber, 2026).

Their fix: each workload fetches a SPIFFE-verifiable ID from SPIRE, then a Security Token Service mints a single-hop JWT with a specific audience and a time-to-live in the order of minutes (Source: Uber, 2026). The exchange follows OAuth 2.0 Token Exchange (RFC 8693) and embeds the full actor chain, so a gateway sees the engineer, the on-call agent, and every step between (Source: Uber, 2026).

P99 latency for that exchange sits below 40 milliseconds in production, and the system is adopted by thousands of internal agents (Source: Uber, 2026).

Scoped Spending Shows the Same Shape

The pattern is not confined to infrastructure. OpenAI's ChatGPT Wallet, launched on 13 November 2026, lets an agent complete a purchase only after the user reviews the items, the total, and the card, then approves with Face ID or a fingerprint, which creates a record of the transaction (Source: TechCrunch, 2026).

The wallet charges through a payment token that stands in for the card details, so neither the agent nor the merchant receives the number (Source: TechCrunch, 2026). Spending limits and category or time-window parameters are planned, so users can pre-approve narrow slices of autonomy (Source: TechCrunch, 2026).

Read beside Uber's architecture, the controls are the same three: an identity, a scope, and a recorded approval.

Where the Kill Switch Runs Out

The limits are documented too. Uber reports guardrails reduced risk and raised the cost of exploitation without eliminating it, and that the most effective mitigation was the least glamorous one: explicit intents and constraints, at the cost of flexibility (Source: Uber, 2026).

Reviewers raised the structural gap. UN senior information technology officer Tristan G. noted that per-agent personas and constraints scale with the number of workflows, and asked how the model works for vendor or SaaS agents where you cannot insert your own enforcement hooks (Source: InfoQ, 2026).

A kill switch exists only where an enforcement point exists. For third-party agents the levers shrink to deregistration, refusing tokens at the gateway, and cutting the network path, and teams that never built them find the gap during an incident.

What This Means in the Philippines

NPC Advisory No. 2024-04 requires personal information controllers to stay accountable for AI processing outcomes and to put privacy impact assessments, human intervention protocols, and grievance mechanisms for automated decisions in place (Source: National Privacy Commission, 2024).

Each requirement maps onto a component an agent architecture either has or lacks: the registry is the accountability record, the execution trace is the audit trail a grievance review would read, and the enforcement hook is where human intervention actually stops an action.

For Philippine teams the ordering is simple: registry and trace before autonomy, because an agent you cannot name in a log cannot be defended.

FAQ

Q: What does Uber's Secure AI framework actually enforce?
A: Three layers: provisioning-time validation via the AI Registry and Argus, runtime enforcement via AI Guard decisions applied by Agent Guard hooks, and continuous assurance via traces, replay, and red teaming (Source: Uber, 2026).

Q: Does per-hop agent identity add noticeable latency?
A: Uber reports P99 latency below 40 milliseconds for its token exchange in production, adopted by thousands of internal agents (Source: Uber, 2026).

Q: What is the biggest governance gap for third-party agents?
A: Enforcement hooks: per-agent effort scales with workflow count, and vendor or SaaS agents cannot host your hooks (Source: InfoQ, 2026).

Key Takeaway

Uber's own conclusion is the useful one: personas, scoped intents, constraints, and provenance are not scaffolding to remove as models improve, but the controls that matter more as autonomy grows (Source: Uber, 2026).

Before your next agent ships, settle three questions in the architecture, not the incident report: can you name the actor on every hop, can you show the scope that authorized it, and can you stop it where you control?

Sources