IBM Agent Identity: How to Give Every AI Agent Its Own Credentials

In short: On 26 and 27 October 2026 IBM announced Agent Identity, generally available, together with HashiCorp Vault 2.2 and new controls in watsonx Orchestrate. The idea is simple: treat every AI agent like an employee account. It has an owner, a record of what it may do, credentials that expire quickly, and a way to switch it off. Whether or not you buy from IBM, the checklist behind it is what any business running AI agents will need.

Key Takeaways

• IBM's pitch is that agents need their own identity: a record of who owns the agent, its lifecycle status and the authority it has been granted.
• Vault 2.2 issues short-lived, dynamically generated credentials to agents, so a leaked key stops working quickly and access can be revoked in real time.
• IBM quotes Gartner: by 2028 the average Fortune 500 company will use over 150,000 AI agents, yet only 13% of organizations believe they have the right agent governance in place.
• The watsonx Orchestrate additions are Discover (find agents across clouds), Contain (isolated sandboxes with a kill switch) and Evaluate (test agents, models and MCP servers, with cost tracking).
• Discover and Contain are tech previews, not generally available. Agent Identity and Evaluate are generally available.
• This is a vendor announcement. We have not tested these products, and the Gartner numbers are as quoted by IBM.

What IBM Announced

IBM published two related items in late October 2026. On 26 October it announced that IBM Agent Identity is generally available. On 27 October, at its TechXchange event in Atlanta, it announced a wider package under the heading "identity and control for AI agents".

The parts, as described in IBM's release:

• Agent Identity (generally available). A central record for each agent: who owns it, its lifecycle status and the authority it has been granted. It covers registration, delegation on behalf of a user, short-lived task-scoped tokens, and audit trails.
• HashiCorp Vault 2.2 (generally available). Gives agents their own secured accounts, renews their credentials automatically and issues short-lived credentials that can be revoked. If an agent tries an action outside its permissions, IBM says access can be denied and the session revoked in real time.
• watsonx Orchestrate: Discover, Contain, Evaluate. Discover (tech preview) finds agents running on Amazon Bedrock, Microsoft Foundry and Google Gemini. Contain (tech preview) runs agents in isolated sandboxes and adds a kill switch. Evaluate (generally available) tests agents, models and MCP servers and tracks cost.
• Secure Hub (public preview). Central visibility across Vault environments.

IBM also says the package works with NVIDIA's OpenShell secure runtime. We covered that runtime in our post on NVIDIA OpenShell and safe AI agents.

Why Agents Need Their Own Identity

Most early agent projects run on a shared API key or the credentials of whoever built the prototype. That works in a demo and fails in production for three reasons:

1. No owner. When an agent does something wrong, nobody can say whose it is or what it was allowed to touch.
2. Over-broad access. A key that can read everything is a key that can leak everything if the agent is tricked by a malicious instruction hidden in an email or web page.
3. No quick way to stop it. Revoking a shared key breaks every other agent that uses it, so teams hesitate.

Giving each agent its own account, with permissions scoped to its task and credentials that expire, turns each of these into an ordinary operations problem. That is the whole point of the announcement.

A Practical Checklist for Any Business

You do not need a large vendor stack to apply the idea. For each agent you run:

1. Keep an inventory. A list of every agent, what it does, which systems it can reach and which person owns it.
2. Use separate credentials per agent. Never share a key between agents or reuse a person's login.
3. Grant the minimum. Read-only where possible, one system rather than all of them, one task rather than open-ended.
4. Prefer short-lived access. Credentials that expire limit the damage of a leak.
5. Log actions, not just conversations. You want to answer "what did this agent change, and when?"
6. Have a stop switch you have tested. Know how to cut an agent off within minutes, and practise it.
7. Treat tool connections as part of the attack surface. Our OWASP MCP Top 10 explainer and the Microsoft Execution Containers post cover the neighbouring risks.

What to Be Careful About

• Tech preview is not production. The discovery and containment features are previews, and details can change.
• Vendor figures. The 150,000-agent and 13% numbers are Gartner's, quoted by IBM. For a small or mid-sized business the lesson is the direction, not the scale.
• Lock-in. Identity and credential tooling sits close to the centre of your stack. Ask how it works with the systems you already use before committing.

The Short Version

Agents that can act need the same basics as staff who can act: a named owner, limited permissions, expiring access and a way to be switched off. IBM's announcement packages those basics for large enterprises. The checklist above applies at any size, and it is much easier to set up before you have dozens of agents than after.

If you are planning agents for your own operations, see how we approach custom AI agent development, and our AI agent security checklist whitepaper.

Related Insights

• Microsoft Execution Containers: How to Contain an AI Agent
• OWASP MCP Top 10 Explained for Business Owners
• AI Agents Are Getting Their Own Infrastructure

Sources

• IBM, IBM Introduces Identity and Control for AI Agents, Securing Frontier Intelligence for the Enterprise, October 27, 2026
• IBM, IBM Agent Identity is now generally available: Building trust for the agentic era, October 26, 2026