Uber publishes Secure AI, a layered framework for securing production AI agents

Uber has published the framework it uses internally to keep AI agents safe in production, under the name Secure AI. According to a dev.to summary of the Uber Engineering post, dated November 6, 2026, the approach stacks three layers: validation when an agent is provisioned, enforcement while it runs, and continuous assurance after deployment.

The starting premise is that identity and authorization remain necessary but stop being sufficient once software reasons over untrusted content, chooses its own tools and acts on a user's behalf. Access control answers who may do what; it says little about whether a given action makes sense in context.

From access control to behavior control

Uber's argument is that agentic systems need a semantic layer that decides not only whether an agent is permitted to act, but whether it should, considering the request, the agent's purpose and the session history. The dev.to writeup lists five risk categories motivating the shift: prompt injection, tool and memory poisoning, goal hijacking, behavioral drift, and hallucination-driven actions.

Rather than maintaining rules for a near-infinite set of attack variants, Uber moved toward semantic, behavior-based enforcement.

Provisioning: a registry and a behavioral contract

Before an agent ships, its properties are recorded in the Uber AI Registry: identity, ownership, persona, permitted intents, constraints, dependencies and a risk tier. Together these form what Uber calls a behavioral contract — a declarative statement of what the agent is supposed to do.

A platform named Argus then tests that declaration against reality by analyzing agent source code, prompts, configurations, dependencies and tool invocation paths, so that declared behavior can be compared with observed capabilities. Third-party MCP servers and tools are subjected to static and dynamic analysis, composition analysis and semantic inspection of their tool descriptions — effectively supply-chain vetting for agent tooling.

Runtime enforcement with small local models

At runtime, the architecture splits policy administration, policy decision and policy enforcement into separate pieces, extending the familiar pattern from authorization systems out of resources and into behavior. The AI Registry acts as the administration point, AI Guard serves as the decision point, and Agent Guard hooks — wired in through LangFx or the AI Guard SDK — enforce decisions at sensitive points in the agent's execution.

Per the writeup, AI Guard relies on small specialized models that run locally, some fine-tuned to a single guardrail task. Running inference on the same infrastructure as the agent trims latency and allows each agent to be calibrated individually.

Assurance: provenance, replay and red teaming

The third layer is continuous assurance. Prompt provenance and evidence chaining connect privileged actions to the user's original request, so consequential steps are traceable rather than merely logged. End-to-end observability, replay of recorded interactions against candidate guardrails, threat modeling and continuous red teaming complete the loop.

Uber's own conclusion, as reported by dev.to, is that its most effective mitigation was also its least glamorous: limiting agents to explicit intents and constraints, trading some flexibility for predictability.

Why it matters

Agent deployments are moving from demos into production, and much of the available security guidance still amounts to sanitizing prompts. Secure AI is a concrete, working reference architecture: a registry that declares intended behavior, a decision service that judges behavior at runtime, and hooks that enforce it inside the execution path. Platform teams can adopt the registry, decision point and hook pattern with their own components, and anyone exposing tools through MCP should expect consumers to start running supply-chain checks on them.

The quieter lesson is cultural. Uber found that narrowing what agents are allowed to do paid off more than clever detection did — a useful counterweight to the common instinct of shipping maximally capable agents and patching the risk later.