IBM offers governed identity and credential controls to AI agents

IBM on October 27, 2026 announced new identity, credentialing, discovery, containment and evaluation capabilities for enterprise AI agents at TechXchange 2026 in Atlanta, including the general availability of IBM Agent Identity and HashiCorp Vault 2.2.

The company said the features are designed for developers, IT and security teams running agents on enterprise systems with defined authority and responsibilities, combining agent detection, verified identities, access controls and performance evaluation. “Enterprise AI winners are changing the way their business works, not simply adding more AI to it,” said Dinesh Nirmal, senior vice president of IBM Software, in IBM’s announcement. Nirmal said agents doing real work need an AI operating model that connects them to a company’s data, applications and infrastructure.

IBM’s announcement tied the implementation to governance gaps in current enterprise implementations. Gartner predicted in an April 28, 2026 press release that by 2028 the average global Fortune 500 enterprise will have over 150,000 agents in use, up from fewer than 15 in 2025, and that only 13% of organizations believe they have the right AI agent governance in place. IBM has identified persistent credentials, unclear ownership and disconnected controls as the obstacles against which the new capabilities are aimed.

Agent Identity and HashiCorp Vault

Agent Identity, detailed in an IBM announcement published on October 26, 2026, registers agents in a central inventory and captures properties, metadata, risk ratings, connections to approved tools, and lifecycle status. IBM said the system preserves delegation on behalf of all identity providers and token exchanges so that an action can be traced back to an originating person, approval state, or upstream system, and issues OAuth-based, short-lived, task-scoped tokens with consent-aware authorization for sensitive actions. The controls remain in place while an agent is running and cover contextual authorization, policy enforcement, run-time risk assessment, and credential checking. Structured audit trails connect human identity, delegated agent identity, credentialing, policy decisions, and downstream actions for compliance reporting and incident investigation.

Within the architecture, IBM Verify provides centralized identity, authorization, governance, token exchange, and audit controls, while HashiCorp Vault provides just-in-time, system-specific credentials that cannot directly use delegated tokens. Used with Vault, IBM said, Agent Identity establishes the authoritative record for each agent, covering their owner, lifecycle state and granted authority, and shares that context with Vault’s credential controls to enforce least privilege access and enable real-time revocation when an agent attempts an unauthorized action.

IBM said Vault already protects non-human identities for organizations including ABN AMRO, Adobe, athenahealth, BBVA, BlackRock, Canva, Duke Energy, Expedia, London Stock Exchange, Starbucks, Swiss Federal Railways and Target. Vault 2.2 gives agents their own secure accounts, automatically renews their credentials, and incorporates post-quantum cryptography. According to HashiCorp’s update summary, the release adds vTPM support for Linux virtual machines, allowing workloads to authenticate with cryptographic proof tied to a registered virtual TPM rather than distributed bootstrap secrets, along with PKI modernization, automated public certificate management, and Vault on IBM Power.

Two related previews extend the Vault portfolio. Secure Hub, in public preview, provides centralized visibility, reporting and governance across distributed Vault environments, including operational health, secrets and certificates. Vault Arc, also in public preview, introduces a new resource and IAM model with scoped and ephemeral authorization and governance of agents and non-human identities. HashiCorp Boundary 1.1 is available with a Model Context Protocol server in public preview, which allows administrators to manage Boundary clusters in natural language and enables MCP-aware agents to reach SSH and RDP targets without custom client code; the release also adds app tokens with custom lifetime and scope, and automatic virtual machine discovery across multiple AWS accounts from a single plugin configuration.

Discovery, containment, and evaluation in Watsonx Orchestrate

IBM’s Watsonx Orchestrate announcement introduces an AI gateway that serves as a single application layer for discovering third-party agents, models, and MCP servers across platforms such as Amazon Bedrock, Microsoft, and Google, with customers able to interact with those agents via Watsonx Orchestrate chat and channels. The discovery functionality, in technical preview, connects to platforms such as Amazon Bedrock, Microsoft Foundry and Google Gemini to find agents created in third-party environments and extends to MCP models and servers.

The Orchestrate catalog is evolving into a regulated catalog aligned with OWASP, CoSAI and IBM AI Risk Atlas. For selected agents, including Ziemacs and Cognos Partners, performance, reliability and latency metrics are displayed as well as information on compliance with EU AI law; for select MCP servers, including Box, Visier, and New Relic, shows protocol compliance, tool schema integrity, and default credential rejection.

A containment feature, also in technical preview, runs agents in isolated sandboxes and gives teams a kill switch to shut down any agent, while a Premium Runtime provides isolation of the virtualized container from the hardware, zero lateral movement, and containment of hardware-bound resources. Evaluation tools are generally available: teams can test the quality, accuracy and conformance of MCP agents, models and servers before deployment and monitor them in production, with built-in cost monitoring of model usage and tokens. New tools include custom LLM evaluation as a judge, user simulation with deterministic evaluation, Trace Inspector, and an AgentOps agent that investigates faults and generates test cases. Orchestrate can also connect directly with Microsoft Entra and IBM Verify as an identity provider for human and non-human agent identities.

NVIDIA Integration, Availability and Conference Program

IBM said Agent Identity and HashiCorp Vault integrate with NVIDIA OpenShell secure runtime software, the foundation of the NVIDIA OpenShell architecture, combining a secure runtime environment with verified identity and short-lived credentials for each agent. John Fanelli, vice president of enterprise software at NVIDIA, said the work combines OpenShell’s policy-governed runtime with Agent Identity and Vault to support secure execution and restricted access to enterprise systems.

Subject to availability, HashiCorp Vault 2.2, Agent Identity, Watsonx Orchestrate assessment capabilities, IBM Concert, and Terraform policy are generally available; Secure Hub, Terraform Developer Portal, Terraform remote MCP server, and IBM Z Atlas are in public preview; and IBM Integration Intelligence Hub and Orchestrate detection and containment capabilities are in technical preview.

Conference speakers include athenahealth on automating certificate management with the Vault PKI engine; Albert Einstein College of Medicine on applying IBM Verify and Vault to agent identity, just-in-time access, dynamic secrets, and auditability; Optum on radar and Vault border; Seven-Eleven Japan on Vault Enterprise and Vault Radar; and Yum! Brands on building an identity security platform with IBM Verify. Shailesh M. Shenoy, assistant dean for information technology at Albert Einstein College of Medicine, said technologies like IBM Verify and HashiCorp Vault can help organizations establish the identity, access and security controls needed to innovate with confidence.

IBM said this year’s TechXchange, which incorporates HashiConf, brings together nearly 6,500 participants from 85 countries, with more than 1,000 sessions, 180 hands-on labs, 260 customer-led sessions and more than 50 certification exams.