IBM wants every AI agent to have an owner, an ID and a kill switch

At its TechXchange conference, IBM announced that Agent Identity and HashiCorp Vault 2.2 are generally available. Together they give each AI agent a governed identity and short-lived credentials that can be revoked in real time. Cross-vendor agent discovery and sandboxing in watsonx Orchestrate remain tech previews.

Identity, short-lived credentials and live revocation

IBM frames agents as a new kind of non-human identity, alongside applications and services. Agent Identity is meant to hold the authoritative record for each agent: who owns it, its lifecycle status and the authority it has been granted. That context is passed to Vault’s credential controls, which issue short-lived credentials limited to what the agent needs. If an agent tries to fetch data or take an action outside its permissions, IBM says access can be denied and the session revoked on the spot.

Vault 2.2 adds secured accounts for agents, automatic renewal of their credentials and post-quantum encryption. A separate product, Secure Hub, is in public preview and gives central visibility across Vault environments.

IBM cites Gartner for the scale of the problem: by 2028 the average Fortune 500 company will run more than 150,000 agents, yet only 13% of organizations think their agent governance is adequate.

Orchestrate tries to see agents it did not build

The second half of the package is IBM watsonx Orchestrate, which IBM positions as a layer that works across vendors rather than inside one platform. Three functions are described:

• Discover (tech preview) connects to Amazon Bedrock, Microsoft Foundry and Google Gemini to find agents built there, and also covers models and MCP servers.
• Contain (tech preview) runs agents in isolated sandboxes and adds a kill switch for any agent.
• Evaluate (generally available) tests agents, models and MCP servers for quality, accuracy and compliance before deployment, then monitors them in production, with per-agent cost tracking by model and token use.

Agent Identity and Vault also integrate with NVIDIA OpenShell, a secure runtime, so each action can be traced and limited. NVIDIA’s John Fanelli said the combination helps enterprises scale agents with secure execution and tightly scoped access.

Who can use what today

Generally available now: Vault 2.2, Agent Identity, the Orchestrate evaluation features, IBM Concert and Terraform policy. In public preview: Secure Hub, the Terraform Developer Portal, the Terraform remote MCP server and IBM Z Atlas. In tech preview: IBM Integration Intelligence Hub and Orchestrate’s discover and contain capabilities.

The announcement gives no pricing, regional availability or licensing tiers, and it does not say whether Agent Identity works without Vault. The security claims, including real-time revocation, are IBM’s own and have not been independently tested. The customer names listed use Vault for existing non-human identities; the one agent-specific example is a conference talk from Albert Einstein College of Medicine on IBM Verify and Vault for agent identity.

The pieces that address the sprawl problem most directly, finding agents on other clouds and containing a rogue one, are the ones still in tech preview. That gap matters for teams that want to act on the Gartner figures today.

Strategy: HashiCorp becomes IBM’s agent security layer

The release shows how IBM is using its largest recent acquisition. It closed the roughly $6.4 billion HashiCorp purchase on February 27, 2025, according to SiliconANGLE, after clearance from US and UK regulators. Vault and Terraform were then infrastructure tools; this release makes Vault the credential layer for agents, and IBM’s pitch is that agent governance is a secrets-management problem it already knows.

Orchestrate’s role has also shifted. At Think 2026 in May, IBM previewed a new Orchestrate as an agentic control plane in private preview, according to IBM’s Think press release. Five months later, parts of it are generally available and the rest are in tech preview. That is a cautious rollout for a product sold as the place to govern agents on rivals’ platforms.

Dinesh Nirmal, IBM’s software chief, said that for agents to take on real work it “requires an AI operating model” connecting them to a company’s data, applications and infrastructure. IBM is betting that buyers want the trust layer to be vendor-neutral and tied into existing infrastructure tooling. The Nvidia link reflects the same logic of pairing a protected runtime with identity. For background on how hardware-level isolation works, see our explainer on GPU confidential computing.