IBM Puts Agent Identity at the Centre of AI Agent Governance
Agent Identity and Vault 2.2 are generally available. The cross-platform discovery and the kill switch, which the headline leads with, are not.
IBM used its TechXchange conference in Atlanta this week to make an argument that has been forming across the industry for about two years: the hard problem in enterprise AI is no longer building agents, it is knowing which ones exist, what they can reach and who answers when one goes wrong. The company’s answer is to treat an AI agent as a non-human identity with the governance a person gets, and it has shipped that capability as generally available. Agent Identity, which sits in IBM’s Verify portfolio rather than in Vault, registers each agent, records its owner and lifecycle status, and holds its granted authority. HashiCorp Vault 2.2, also generally available, turns that record into credentials that expire.
One qualification belongs at the top, because the release’s headline does not carry it. The most distinctive capabilities described, discovering agents built on Amazon Bedrock, Microsoft Foundry and Google Gemini and the kill switch for shutting one down, are in tech preview. Only the evaluation capability is generally available. IBM states this plainly in its availability section, which is more than most vendors do, but a reader who stops at the subheading would come away with the wrong impression.
The 13 per cent problem
The commercial case rests on two numbers. Gartner projects that the average Fortune 500 enterprise will run more than 150,000 AI agents by 2028. Separately, only 13 per cent of organisations believe they have the right agent governance in place. Put together, the gap is not a technology problem in the ordinary sense. It is an accounting problem. An enterprise that cannot list its agents cannot assign owners, cannot scope their access and cannot revoke anything, and every control that follows depends on the list existing.
IBM’s framing is that persistent credentials, unclear ownership and disconnected controls are the three mechanisms of that failure, and each has a specific remedy in what the company shipped. That is a more useful diagnosis than the usual claim that agents need guardrails, because it names what breaks and in what order.
What Agent Identity records
Agent Identity is a control plane rather than a credential store. It registers agents in a central inventory, captures ownership, classifies risk and records which tools each agent may call. It preserves on-behalf-of delegation across identity providers and token exchanges, so an agent’s action traces back to the person, approval or upstream system that started it.
That last property matters legally as much as technically. An agent acting on behalf of a user, with the delegation preserved through the chain, produces an audit trail that ties a human identity to an agent identity to a credential issuance to a policy decision. Without it, an action taken by an agent is an action taken by nobody in particular, which is not a defensible position in a regulated business.
Access narrows through OAuth-based, short-lived, task-scoped tokens. For systems that cannot consume delegated tokens at all, older applications, on-premise databases, mainframe interfaces, Vault brokers just-in-time credentials that expire quickly. IBM’s own engineers describe the aim as removing standing privileges rather than managing them, which is the right way round.
Credentials as the boundary
The release makes a point worth taking seriously: an agent’s credential is the security boundary, not its code. An agent holding a long-lived, overprivileged credential is a liability whether or not it misbehaves, because compromise of the credential is equivalent to compromise of everything the credential reaches. IBM’s design closes this by denying access and revoking the session in real time when an agent attempts something outside its approved permissions, rather than waiting for the credential to expire.
Vault 2.2 adds two things beyond that. Agents get their own secured accounts with automatic renewal. And the product adds post-quantum encryption, which in a secrets manager is early. Most enterprise cryptography roadmaps still treat post-quantum migration as a problem for the end of the decade; putting it into the credential layer now means the secrets an attacker harvests today are less useful later, which is the specific threat model that motivates the work. Vault 2.2 also addresses what HashiCorp calls the Secret Zero problem, letting on-premise workloads authenticate using cryptographic proof tied to an enrolled virtual TPM rather than a distributed bootstrap secret.
Discovery, and what is not shipped
The orchestration story is the one that needs the qualification stated above. IBM positions watsonx Orchestrate as a control plane that works across the AI ecosystem rather than inside one vendor’s platform. IBM describes its AI Gateway as a single enforcement layer for discovering third-party agents, models and MCP servers on Amazon Bedrock, Microsoft Foundry and Google Gemini, with a governed catalogue aligned to OWASP, CoSAI and IBM’s own AI Risk Atlas, surfacing risk signals and compliance information including EU AI Act references.
That is a genuinely useful idea, because agent sprawl is happening across clouds whether or not anyone planned it. But discovery and containment are both tech preview. A customer cannot buy the cross-platform inventory today. What a customer can buy is evaluation: testing quality, accuracy and compliance before deployment, monitoring in production, and per-agent cost tracking of model and token use.
The Kill Switch
The kill switch sits in the same preview bucket. Isolated sandboxes so one rogue agent cannot interfere with others, and a switch to shut any agent down, are the two controls an operations team would most want on the first day, and neither is generally available. The sequencing is defensible, since containment needs the inventory to work against, but it does mean the product IBM announced and the product IBM sells are not the same product this week.
The catalogue point deserves a sentence of its own. A governed catalogue that surfaces evaluation data at the moment of discovery, and aligns its risk classification to OWASP, CoSAI and IBM’s own AI Risk Atlas, is trying to solve a subtler problem than sprawl: two teams in the same company will build the same agent twice, neither knowing the other exists. Whether a vendor’s risk taxonomy becomes the one enterprises actually use remains open, and IBM is not the only company proposing one.
Scaling with NVIDIA
One integration deserves separate mention. Agent Identity and Vault connect to NVIDIA OpenShell, the secure runtime that underpins NVIDIA’s OpenShell Architecture, so that each agent gets a protected execution environment alongside a verified identity and short-lived credentials. John Fanelli, NVIDIA’s vice president for enterprise software, described the combination as pairing a policy-governed runtime with verified identities and tightly scoped access. The pairing is the right shape: a sandbox without identity limits what an agent can do to the machine, identity without a sandbox limits what it can do to the network, and an agent that acts autonomously needs both limits at once. Neither company has published an independent assessment of what the combination actually prevents.
Who is using it
IBM named twelve Vault customers, among them ABN AMRO, Adobe, athenahealth, BBVA, BlackRock, Canva, Duke Energy, Expedia, London Stock Exchange, Starbucks, Swiss Federal Railways and Target. The release is careful to say Vault secures non-human identities for them generally rather than that they run agents on it, which is the honest construction.
Five clients spoke at the conference about specific work. athenahealth automates certificate management through Vault’s PKI engine. Optum uses Vault Radar to find exposed secrets and Boundary for just-in-time access. Seven-Eleven Japan centralises and encrypts secrets with Vault Enterprise. Yum! Brands is building an identity security platform on IBM Verify. And Albert Einstein College of Medicine is applying Verify and Vault to agent identity, just-in-time access, dynamic secrets and auditability, the only one of the five describing agent work rather than secrets and certificate work.
What to watch
Three markers. The first is general availability for discovery and containment, because until then the cross-platform claim is a demonstration rather than a product. The second is whether the delegation chain survives contact with real identity providers, since preserving on-behalf-of context across Microsoft Entra, IBM Verify and third-party token exchanges is harder in practice than in architecture. The third is whether customers publish audit outcomes, because the value of a governed agent identity is only provable when an auditor accepts the trail. A fourth is whether the governed catalogue becomes a place buyers actually look, since a catalogue nobody consults is documentation rather than a control.
What it means
The strategic read is that IBM has picked a lane where its existing assets matter. Vault’s secrets management, Verify’s identity governance and Orchestrate’s orchestration each existed before agents arrived, and the agent work is largely the act of connecting them. The commercial logic is straightforward: every agent IBM brings under a governed identity touches Vault for credentials and Orchestrate for orchestration, which makes identity the entry point to the rest of the portfolio rather than a standalone product. That is a coherent strategy and also the reason the preview status of discovery matters more than it might otherwise, since the inventory is what feeds everything else. That is less glamorous than launching a new agent platform and considerably more useful, because another agent will not solve the governance problem. An inventory, a set of short-lived credentials and an audit trail will solve it, and IBM now sells all three.