Enterprise AI projects are reaching the point where agents need access to applications, databases and cloud services, creating a familiar but sharper version of the identity-management problem. The business benefit of autonomous work depends on limiting each agent’s authority and being able to trace or revoke its actions when conditions change.
IBM (NYSE: IBM) on Tuesday introduced a set of capabilities meant to give developers, IT teams and security teams a clearer inventory of AI agents, their owners and their permitted access across business systems. The company is combining new Agent Identity functions with HashiCorp Vault credential controls and additions to watsonx Orchestrate, its agent platform.
IBM’s premise is that an AI agent should be managed as a non-human identity, alongside applications and services. Agent Identity is designed to hold an authoritative record of an agent’s owner, lifecycle status and granted authority. Used with Vault, IBM said, that context can support least-privilege access, short-lived credentials and real-time revocation when an agent attempts an unauthorized action.
That architecture addresses a practical enterprise risk. An agent acting on a long-lived, broad credential could reach systems or data outside the job it was meant to perform. IBM said its approach lets organizations define an agent’s role, constrain the credentials it receives and deny access or revoke a session when the agent acts beyond approved permissions. Those controls do not remove the need for a customer to define roles and policies, but they give those policies a mechanism closer to the application and infrastructure layers where agents operate.
HashiCorp Vault 2.2, now generally available, gives agents separate secured accounts and can automatically renew their credentials, IBM said. IBM also added post-quantum encryption features. Secure Hub, a public preview, is intended to provide centralized visibility into Vault environments, including operational health, usage and security resources. The distinction in availability matters for buyers: Vault 2.2 and Agent Identity can be evaluated as current products, while Secure Hub plans should account for preview status.
IBM also expanded the agent-management side of watsonx Orchestrate. Its Discover capability, in tech preview, is designed to find agents, models and MCP servers in third-party environments rather than requiring teams to add each one manually. Contain, also in tech preview, runs agents in isolated sandboxes and includes a kill switch. The company said its Evaluate functions can test quality, accuracy and compliance before deployment, monitor production behavior and track model and token use so teams can identify drivers of AI spending.
For CIOs and security leaders, the value is not simply another agent catalog. The useful question is whether identity, credential issuance, evaluation and operational response are connected tightly enough to manage an agent through its full lifecycle. IBM said watsonx Orchestrate can work with Vault and Agent Identity so enterprises can establish an agent’s assigned work, govern its authority and audit actions while access remains active.
IBM also extended its broader operations portfolio. IBM said Concert can combine observability, optimization, incident management and security to help teams assess high-risk vulnerabilities and coordinate responses in hybrid environments. New HashiCorp Terraform features include generally available policy controls and a remote MCP server in public preview, intended to give developers and agents governed access to approved infrastructure configurations.
Legacy identity and secrets-management programs were built largely around people, applications and infrastructure services. IBM is positioning its additions as a way to bring AI agents into that same control plane, rather than treating them as exceptions layered onto business systems. The competitive test will be whether enterprises can apply those controls consistently across agents from multiple platforms without turning governance into another manual integration project.