The gap Uber describes is a category error in the identity model rather than a missing feature. Its existing scheme knows humans, and it knows workloads carrying credentials such as service accounts or API keys [6]. An agent, in Uber's own definition, is an entity authorized to act for or in the place of another, usually running as a workload doing something on behalf of a person [c6b]. That relationship is exactly what neither category encodes, so the strongest true statement the system can make about an agent-authored change is which workload made it.
Uber's illustrative incident involves one human and three named agents, with three handoffs: the engineer to the Oncall Agent, the Investigation Agent to the Monitoring Agent, and the Monitoring Agent to the code review system, where the artifact a human will later be asked about is created [11]. That is the small case. Because context is dropped at each hop [7], the number of places provenance can go missing scales with workflow composition, which Uber says is the normal shape of agentic work [13], and not with model quality.
The cost that compounds sits in the authorization layer. Uber notes that incomplete provenance limits its ability to apply consistently the fine-grained access policies downstream systems already have configured [7]. Those policies were written to evaluate a caller. When the caller resolves to a shared workload credential, the policy can only rule on what it is handed, and the organisation keeps the audit obligation while losing the use of controls it has already built and paid for.
The tradeoff Uber names is verifiability against velocity: it chose to extend the Zero Trust architecture it already ran rather than gate agents behind something new, explicitly to avoid slowing developers [8], with the stated aim of verifiable cryptographic identity plus enforced authorization downstream [9]. Note the order of operations. Platform first, in early 2025 [1], identity and access work through the rest of the year [3]. Teams walking the same path should expect the retrofit bill roughly a quarter or two behind the first successful demos.
A skeptic's objection is fair, and Uber raises it before anyone else can: this is one company describing its internal architecture and controlled production environments, and it says design choices and security controls may vary elsewhere [12]. That properly limits how much of the implementation transfers. The problem statement transfers further, because it follows from making existing service APIs agent-callable over MCP [2], which is the same move a great many enterprises are making with the same assumption that the caller is either a person or a service.
The board-deck version of this is a maturity story, and Uber frames the accountability question in board language itself: auditing, compliance and executive trust [4]. What the deck cannot yet carry is enforcement. The published material stops after the Agent Registry [15], described as the source of truth for agent-to-workload registration and consumed by a Security Token Service that verifies the agent [10]. On how a delegation chain is minted and checked in practice, this record does not say, and a registry is not by itself a check. Until that half is visible, the honest reading is that attribution here is designed for, not yet demonstrated, and the difference is what an auditor will eventually test.
