IBM adds Agent Identity and Vault controls so companies can cut off rogue AI agents
Announced · Published · By Contractor AI Shop
At TechXchange, IBM announced Agent Identity and extended HashiCorp Vault to AI agents, giving each agent an owner, lifecycle status and short-lived credentials limited to what it needs. Access can be revoked in real time if an agent exceeds its permissions. watsonx Orchestrate Discover and Contain are in tech preview.
Key facts
- IBM says Agent Identity records each agent's owner, lifecycle status and granted permissions, and HashiCorp Vault issues short-lived credentials limited to what the agent needs, with real-time revoke if it exceeds scope. IBM Newsroom
- IBM says watsonx Orchestrate is adding Discover (finds agents, models and MCP servers on Amazon Bedrock, Microsoft Foundry and Google Gemini) and Contain (isolated sandboxes with a kill switch); both are in tech preview. IBM Newsroom
- Techzine (Berry Zwets) reported the Vault extension for AI agents, Agent Identity, Secure Hub preview, NVIDIA OpenShell integration and Orchestrate Evaluate GA. Techzine (Berry Zwets)
- Fierce Network (Diana Goovaerts) reported from an IBM media call, quoting Tyler Lynch on recursive agent loops that could run up "$10,000 a day," and described a demo where denying an out-of-scope request revoked the agent's session. Fierce Network (Diana Goovaerts)
Our take: what it means for contractors
Third big agent-governance launch this week after Salesforce and NVIDIA's OpenShell/Sentry. For any contractor letting an agent touch accounting or project systems: give each agent its own login and owner, and make sure someone can cut it off. Don't let it borrow a person's credentials.
What we don't know yet
- Pricing
- Exact GA vs preview status of Agent Identity itself
- Whether any of this matters below enterprise scale
Sources
- IBM Newsroom · IBM Introduces Identity and Control for AI Agents, Securing Frontier Intelligence for the Enterprise · 2026-10-27 · Primary
- Techzine (Berry Zwets) · IBM deploys HashiCorp Vault for AI agent identity · 2026-10-27 · Secondary
- Fierce Network (Diana Goovaerts) · IBM reins in rogue AI agents with identity and runtime controls · 2026-10-27 · Secondary