Detection Is Downstream of Authorization

Uber open-sourced its agent security stack this week. The one component it held back names the gap the whole field is standing over.

This week Uber open-sourced ADR, its Agentic Detection and Response system, after ten months running it in production against coding agents used across the company. The work is real. The Sensor normalizes agent telemetry across at least seven AI coding tools on macOS, Linux, and Windows. The benchmark packages just over three hundred scenarios and 133 MCP servers. The detector pairs a high-recall triage model with a deeper reasoning agent that fires only on sessions the triage flags.

A top engineering organization treating agent security as a first-class problem, then releasing the framework, is a good day for the field. Read the repository closely and it states something the authors do not hide. The one component that would stop an unsafe action is not in the release. The README marks Prevention as not included, with a note to stay tuned. What ships observes and classifies. What would act is held back, and the honesty of the release sits precisely in that boundary.

Why detection keeps arriving second

Enterprise governance has spent thirty years building systems that reconcile a decision after it was already made. Master data management promised one canonical record and produced a copy that drifted the moment it was written. Data loss prevention promised coverage and produced a sensor grid with holes exactly where traffic learned to route. The architecture underneath is constant. Observe the world, compare it to policy, raise a finding. The finding lands after the act.

Detection for agents inherits that lineage. The ADR detector returns its verdict on a completed conversation. Sessions flagged by the two tiers route to a human review queue, where analysts label each one as a true positive, a true positive non-malicious, or a false positive. The unit of judgment is the session, evaluated once the agent has already called its tools. The deeper reasoning pass uses a capable model that adaptively queries source code, threat intelligence, and policy providers before returning a verdict. That is forensics with good latency, and forensics is not a gate.

Policy does appear in the system. It enters as one of the context sources the reasoning model can consult while forming its judgment. Policy informs the classification. It never decides the action. That distance is the whole argument.

What changed, and why the gap is now load bearing

For a human operator, after-the-fact review was tolerable. A person acts a few times an hour, and a flagged mistake can usually be walked back. Agents broke both assumptions. They act thousands of times a minute, and a growing share of what they do cannot be undone. A payout clears. A record is deleted. When the action is irreversible and the verdict arrives behind it, the verdict is a report of what already happened.

The announcement is candid about what production taught the team. Approval fatigue turns human oversight into a rubber stamp once a user faces dozens of prompts a session. The dangerous attacks hide inside chains that look benign one step at a time. Leaked credentials, more than prompt injection, turned out to be the common failure. Each lesson says the same thing in a different register. The decision cannot sit with a human at machine speed, and it cannot be recovered by watching behavior, because the dangerous action is the one that looks legitimate until state has moved underneath it.

A more accurate classifier still classifies after the fact. What closes the seam is a decision made at the action, before it runs.

The Authorization Gap

Every agent action carries an implicit claim. This actor is allowed to perform this operation on this target, right now, under current policy and current standing. Detection never evaluates that claim. It assumes the action occurred and asks whether the trace looks wrong. The claim itself, the authorization, is the layer underneath, and in most agent stacks nothing occupies it.

This is the Authorization Gap. A verdict at the point of action, computed against live policy and the actor's present entitlement, rendered before the operation executes, and binding on that single action rather than a session or a token minted earlier. Monitoring does not fill it. A system missing that layer can observe everything and authorize nothing.

The proof is in what the field ships. When the most disciplined detection release on the market draws its line, the observing and classifying parts go out and the part that would act on a verdict stays in. The component held back marks the exact place where detection ends and authorization has to begin.

What builders and buyers should take from this

For builders, order of operations decides the ceiling. Telemetry and detection are worth having, and they compose cleanly on top of an authorization layer that has already decided what may run. Built the other way around, with detection standing in for a decision that was never made, the system inherits the coverage ceiling that capped DLP. Its value tracks sensor breadth, and sensor breadth decays.

For buyers, the sharper question is not how well a system detects. It is where the decision to allow an action is made, and when. If the answer is that the system flags risky behavior after execution, that is response, and response presupposes an authorization step that someone still owns. Ask who owns it. The honest vendors, the ADR team among them, will tell you it is not in the box yet.

The category is validating fast. A production release from a company at Uber's scale confirms that agent governance is a real market. The open question was never whether agents would be watched. It is who renders the verdict at the moment an agent acts.

Detection tells you what an agent did. Authorization decides whether it should have been allowed. That decision has to come first.

Cross-link: this piece extends the argument coined in N° 020 (The Authorization Gap) and attaches it to a fresh, verifiable market moment. Companion in spirit to N° 018 (The Question No One Signed) on the accountability arc, N° 025 (The Oversight Illusion) on the same paper-versus-behavior pattern applied to human oversight, and N° 026 (The Declaration Gap) on the same pattern applied to national and vendor declarations. Uber ADR release details verified against github.com/uber/ADR README and the paper at arxiv.org/abs/2605.17380. Prevention component held-back status verified verbatim from the repository README. Production lessons paraphrased from Praveen Neppalli's public launch statement, not directly quoted. Reasoning-agent behavior described from Section 3.2 of the paper. Reciprocal: FederatedIQ implements the at-the-action authorization boundary argued here at federatediq.ai.