IBM ties agent identities to short-lived credentials, with discovery still in preview

IBM’s [October 27 TechXchange announcement](https://newsroom.ibm.com/2026‑10‑27‑ibm‑introduces‑identity‑and‑control‑for‑ai‑agents%2C‑securing‑frontier‑intelligence‑for‑the‑enterprise) brings agent identity, credential controls and evaluation into a broader enterprise‑AI operating model. The immediate distinction is between knowing that an agent exists and defining the authority it is allowed to exercise. A service account with a familiar name does not, on its own, explain who delegated a task or which actions were approved. The company’s [Agent Identity announcement, published October 26](https://www.ibm.com/new/announcements/ibm‑agent‑identity‑is‑now‑generally‑available‑building‑trust‑for‑the‑agentic‑era), says the product is generally available. It describes a central record of agents, their owners, approved tool connections and lifecycle status. Delegation context can connect an agent’s actions to a person, an approval state or another system. The new conference announcement therefore builds on an already dated availability notice; October 27 is not the first documented release of Agent Identity.

The [Agent Identity description](https://www.ibm.com/new/announcements/ibm‑agent‑identity‑is‑now‑generally‑available‑building‑trust‑for‑the‑agentic‑era) separates identity and authorization from the credentials used to reach a business system. IBM Verify handles identity, delegation, token exchange and audit controls. HashiCorp Vault complements that layer by brokering temporary, target‑specific credentials for systems that cannot directly consume delegated tokens. IBM says the architecture can use short‑lived, task‑scoped tokens rather than broad standing access. Its [TechXchange release](https://newsroom.ibm.com/2026‑10‑27‑ibm‑introduces‑identity‑and‑control‑for‑ai‑agents%2C‑securing‑frontier‑intelligence‑for‑the‑enterprise) also describes denying access and revoking a session when an agent attempts something outside its permissions. These are the vendor’s descriptions of supported controls. They do not establish that every customer’s tool connection is correctly scoped or that revocation has been independently tested against a particular threat. The practical difference is that an agent’s identity can remain accountable while the permission it receives is limited to a task and a period of time. Maintaining that distinction matters when agents call tools, reach databases or hand work to other agents.

IBM’s [availability section](https://newsroom.ibm.com/2026‑10‑27‑ibm‑introduces‑identity‑and‑control‑for‑ai‑agents%2C‑securing‑frontier‑intelligence‑for‑the‑enterprise) lists Vault 2.2, Agent Identity and the evaluation capabilities in watsonx Orchestrate as generally available. The evaluation tools are described as a way to assess agents before deployment and monitor them in production, including their model and token use. Other parts of the proposed management layer are at an earlier stage. Orchestrate’s Discover capability for finding agents in third‑party environments and its Contain capability for isolation and shutdown are technology previews. Secure Hub, which provides visibility across Vault environments, is in public preview. Those labels should stay attached to the features when planning a rollout; they are not interchangeable with the generally available identity and credential components.

For an enterprise team evaluating the [architecture](https://www.ibm.com/new/announcements/ibm‑agent‑identity‑is‑now‑generally‑available‑building‑trust‑for‑the‑agentic‑era), the useful starting point is a bounded agent workflow: who owns it, on whose behalf it runs, which systems it can reach and what should cause its access to end. The announced products supply ways to represent and enforce those decisions; they do not choose an organization’s permitted actions for it. A deployment also needs an audit trail that connects the original authorization, the credential issued and the downstream action. IBM’s descriptions support that operating pattern, while the preview status of discovery and containment limits what can be treated as a generally available part of the same plan. OpenTools has not deployed or independently tested these controls. *Historical company‑context photo: the entrance to IBM’s Thomas J. Watson Research Center in Yorktown Heights, photographed February 23, 2017. Photo: [Autopilot](https://commons.wikimedia.org/wiki/User:Autopilot), via [Wikimedia Commons](https://commons.wikimedia.org/wiki/File:IBM_Watson_Research_Center_entrance.jpg), [CC BY‑SA 4.0 International](https://creativecommons.org/licenses/by‑sa/4.0/). Any displayed crop or resize remains under the same image licence. The photo does not depict the 2026 launch or establish where the products were developed.*