Summary

• IBM Agent Identity and HashiCorp Vault 2.2 are generally available, providing identity records and credential management for AI agents.
• watsonx Orchestrate's evaluation capabilities are released, while cross-platform discovery and containment remain in technical preview.
• The combined approach uses delegated authority, restricted credentials and audit records to govern agents acting across business systems.

IBM has extended enterprise identity and security controls to AI agents, introducing an integrated approach that establishes who owns each agent, which business systems it may access and how its actions can be traced.

The new capabilities bring together IBM Agent Identity, HashiCorp Vault and watsonx Orchestrate as businesses experiment with software agents able to retrieve information, invoke applications and complete tasks across multiple systems.

IBM Agent Identity and HashiCorp Vault 2.2 are generally available, along with agent evaluation capabilities in watsonx Orchestrate. Additional functions for discovering agents across external AI platforms and containing their execution remain in technical preview.

The distinction is important because the released products offer practical identity and credential controls, while IBM’s broader cross-platform governance model includes functions that have not yet reached general availability.

Agents need identities distinct from employees

Traditional enterprise identity systems distinguish between human users and software accounts. Employees authenticate through an identity provider, while applications commonly use service accounts, certificates, tokens or other credentials to access connected systems.

AI agents introduce additional complexity because they may select and invoke different tools while carrying out a task. Their behaviour is not necessarily limited to a fixed sequence of operations specified by a developer.

An agent preparing an expenditure report might need permission to read financial records, examine purchase orders and request supporting information. That work does not automatically justify allowing the same agent to modify supplier bank details or authorise payments.

Giving an agent the full privileges of the employee who requested a task can expose more information and functionality than necessary. It can also make it difficult to establish which actions were performed by the employee and which were initiated by software acting on their behalf.

IBM Agent Identity addresses these problems by maintaining a record of each agent’s ownership, lifecycle status and delegated authority. The product uses IBM Verify to provide identity and authorisation context, allowing organisations to connect agent governance with existing access management arrangements.

That context is intended to accompany the agent through registration, execution and eventual retirement. It provides a basis for identifying who authorised the agent, what permissions were granted and which decisions were recorded during its operation.

Vault restricts credentials and their lifetime

Identity establishes which agent is acting, but the systems it uses must still enforce appropriate access restrictions. HashiCorp Vault provides credentials and secrets management for applications, databases and other services.

Its integration with Agent Identity allows credential issuance to reflect an approved delegation. Rather than providing a permanent secret with broad access, an organisation can issue credentials limited by duration, target system and permitted operation.

Short-lived credentials reduce the period during which a stolen or misused secret remains useful. When an agent’s authority changes or suspicious activity is identified, access can be denied and relevant credentials or sessions revoked.

Vault also supports systems that cannot directly consume modern delegated identity tokens. In those environments, credentials can be issued according to the agent’s verified authority without embedding persistent passwords in its code.

Vault 2.2 extends these arrangements with dedicated accounts for agents and automated credential renewal. IBM also identifies post-quantum cryptographic capabilities among the release’s security developments.

The effectiveness of these controls depends on how organisations configure authorisation policies and whether connected applications enforce them correctly. A short-lived credential still permits actions within its assigned scope while it remains valid.

Revoking access can prevent further operations, but it does not necessarily reverse changes an agent has already completed. Applications processing financial transactions, customer records or operational commands therefore need suitable approval and recovery procedures alongside identity management.

Cross-platform discovery remains in preview

IBM is also developing capabilities intended to identify agents operating across AI platforms such as Amazon Bedrock, Microsoft Foundry and Google Gemini.

The planned discovery service uses watsonx Orchestrate to identify agents, models and Model Context Protocol servers, giving administrators a more complete view of AI systems deployed across an organisation.

That capability remains in technical preview. It should not be treated as generally available coverage of every third-party agent or software environment.

Large organisations may deploy AI through multiple applications and development teams, creating an inventory problem similar to unmanaged software services. Without central records, administrators may struggle to establish which agents exist, which systems they can access and who is responsible for them.

IBM’s proposed discovery tools are intended to address that problem by identifying activity beyond its own software ecosystem. The value of such an approach will depend on the supported integrations and the completeness of information available from each connected platform.

Containment capabilities are also in technical preview. IBM describes isolated execution environments designed to prevent one agent from interfering with others, alongside a mechanism for terminating an agent whose behaviour creates unacceptable risk.

Isolation and shutdown controls provide additional operational safeguards, although their effectiveness depends on the execution environment and the authority available to administrators.

Evaluation adds performance and cost controls

IBM’s generally available watsonx Orchestrate evaluation capabilities address a different part of agent governance: assessing whether agents perform their intended tasks accurately, consistently and within defined constraints.

Organisations can evaluate agents, models and connected tools before deployment, then monitor their behaviour during operation. IBM also provides tracking for model and token usage, allowing teams to examine the computing costs associated with individual agents.

Such monitoring can identify unexpectedly expensive workflows, repeated model calls or changes in system behaviour. These findings can inform further testing, configuration changes or restrictions on agent activity.

Evaluation does not guarantee that an agent will behave correctly in every situation. Test coverage depends on the scenarios selected, the quality of the evaluation criteria and the relationship between those tests and the circumstances encountered in production.

The company is also connecting its identity architecture with NVIDIA OpenShell, which is intended to provide protected execution environments for agents. Combining runtime restrictions with verified identities and limited credentials could constrain both how an agent operates and which resources it reaches.

Existing enterprise systems remain central

IBM’s approach reflects the difficulty of deploying agents across established business software. Organisations already maintain identity systems, application permissions, approval procedures and security records, making it impractical to govern every new AI service through an entirely separate framework.

Techopia previously examined IBM’s deployment of coding agents within customer-controlled infrastructure. That development addressed where AI tools could operate, while the latest identity products address what they may do once deployed.

For companies adopting AI agents, the immediate requirements include registering each agent, assigning an accountable owner and defining the permissions associated with its tasks.

IBM’s released Agent Identity, Vault and evaluation products provide mechanisms for implementing those controls. Its discovery, containment and broader integration functions remain at different stages of development, leaving organisations to assess the available components against their existing security architecture.