IBM paired its new Agent Identity with HashiCorp Vault and watsonx Orchestrate at TechXchange 2026, giving AI agents owners, short-lived credentials, and cross-platform discovery. The credential layer is a practical strength, while runtime authorization remains the harder problem for the whole category.
What Is Covered in This Article:
- The News: IBM Agent Identity and Vault 2.2 are generally available, while watsonx Orchestrate’s Discover and Contain capabilities are in tech preview.
- Vault as the Starting Point: IBM is extending a secrets manager many enterprises already run, though its spending momentum sits more with platform teams than with security buyers.
- Credential Brokering: Vault bridges enterprise systems that cannot accept delegated tokens, as buyers piece together agent controls (29% cite just-in-time entitlements for agents among their top three).
- Authorization Remains Hard: Registration and short-lived tokens are converging across the category, while checking an agent’s actions against what it was delegated to do remains open.
- The Execution Test: Preview-stage discovery and three overlapping agent registries put integration at the center of IBM’s pitch.
The News: At TechXchange 2026 in Atlanta on October 27, IBM announced a set of identity and control capabilities for AI agents, which it positions as the trust layer of an “AI operating model” spanning agents, data, automation, and hybrid infrastructure.
IBM Agent Identity, now generally available, records each agent’s owner, lifecycle status, and delegated authority. Used with HashiCorp Vault, it passes that context to Vault’s credential controls, which issue short-lived, least-privilege credentials and can revoke access in real time. Vault 2.2 adds agent accounts, automated credential renewal, and post-quantum encryption.
Separately, IBM watsonx Orchestrate adds Discover (tech preview), which finds agents, models, and Model Context Protocol (MCP) servers on Amazon Bedrock, Microsoft Foundry, and Google Gemini; Contain (tech preview), which sandboxes agents and adds a kill switch; and Evaluate, which tests agents before deployment and tracks their token costs. Agent Identity and Vault also integrate with the NVIDIA OpenShell secure runtime.
IBM Bets on Vault’s Installed Base to Secure AI Agent Identity
Analyst Take: Agent identity has become one of the more crowded corners of cybersecurity in 2026, and many announcements in the space now cover the same ground: register the agent, assign a human owner, issue short-lived tokens, and keep an audit trail. IBM’s announcement covers those basics too. Its more interesting move sits one layer down, where, roughly 20 months after closing the HashiCorp acquisition, IBM is connecting Verify (its identity platform), Vault, and watsonx Orchestrate into a single trust stack for agents, with Vault carrying much of the weight.
Where Vault already sits matters here, and so does who buys it. In the October 2026 Technology Spending Intentions Survey (TSIS) from ETR, part of Futurum, HashiCorp (IBM) posted a Net Score of 19 in Infrastructure Software (n=189), against 9 in Information Security (n=146), where it accounted for about 10% of active citations.
IBM is extending something many enterprises already run, rather than asking them to adopt a new category, which is a different starting point from most agent identity entrants. The catch is that the spending momentum sits with the platform teams that operate Vault more than with the security teams this pitch addresses.
The Credential Layer Is Where Agent Risk Lands
Agents tend to inherit the habits of the service accounts that came before them: application programming interface (API) keys in code, credentials shared across connectors, and tokens that outlive the task. IBM’s architecture ties credential issuance to a recorded owner and a delegation chain, and uses Vault to broker just-in-time, target-specific credentials for systems that cannot accept a delegated token directly.
That last point deserves credit, because a good share of enterprise systems will never speak OAuth token exchange and something has to bridge them. It is easy to gloss over in designs that start from the identity provider, and IBM addresses it with a component many customers already know how to operate.
The delegation model is also more careful than most. In Vault Enterprise 2.1, generally available since September, an agent acting for a person gets only the overlap of that person’s permissions, a ceiling set for the agent, and the scope requested for the task, with that task scope required by default. HashiCorp validated it against several identity providers, including Okta and Microsoft Entra, which matters for a vendor whose customers may well run someone else’s workforce identity.
Buyers are reaching for this kind of control, though not uniformly. In Futurum’s 1H 2026 Cybersecurity Decision-Makers Survey, 29% of respondents placed just-in-time identity entitlements for AI agents among their top three controls for governing agent access to sensitive data (N=104). That sits in a tight cluster with limiting agents to unclassified data (34%) and human approval for access to the most sensitive data (32%), which to us suggests organizations are still assembling agent governance from several partial controls rather than settling on one.
Authentication Is Converging, Authorization Is the Harder Problem
We see a harder question for the category as a whole, IBM included. Registration, ownership, delegation, and short-lived tokens are quickly becoming expected features. What remains open is whether a goal-directed agent’s actions stay within what it was delegated to do, across the many systems it touches, as it makes intermediate decisions on its own.
IBM describes contextual authorization, policy enforcement, and runtime risk evaluation in Agent Identity, which is real progress. Like comparable capabilities elsewhere, it appears to evaluate policy that someone wrote in advance, within the systems IBM governs. That narrows the gap for actions a policy author can anticipate; the ones nobody anticipated remain the hard part. Prompt injection is the plain example: an agent steered by a malicious instruction that asks for something inside its delegated scope still gets the credential, because nothing at the credential boundary sees why it asked.
Orchestrate Contain’s sandboxing and kill switch are sensible additions, and to us the sandboxing is the more important of the two: limiting what a misbehaving agent can reach does more than switching it off once someone notices.
A Crowded Field Sorting Into Camps
The market has moved fast. Identity platforms such as Okta, Microsoft Entra, SailPoint, and Palo Alto Networks (through Idira, built on CyberArk) have all extended their offerings to agents. Security platforms have bought their way in, with CrowdStrike buying SGNL and Cisco buying Astrix, and hyperscalers such as AWS offering agent identity within their own runtimes, among others.
IBM makes two bets that stand out against that field. Orchestrate Discover aims to find agents built on other vendors’ platforms, which reflects how agents arrive in many forms (built in-house, embedded in enterprise applications, or working on behalf of a person). The architecture is also designed to coexist with existing identity providers rather than replace them, consistent with the multi-provider validation behind Vault.
The Execution Test
Two of the capabilities behind the cross-platform story, Discover and Contain, are in tech preview. Until they are generally available and proven against real multi-cloud agent estates, the promise to govern agents “regardless of where they were built” is a direction more than a finished capability.
Buyers should also expect to work through how the pieces fit. IBM now has three places that track agents (the Agent Registry in Vault, Agent Identity in Verify, and the agentic control plane in watsonx Orchestrate), and customers will reasonably ask which one is the source of truth.
The value IBM describes depends on those pieces reconciling cleanly, which is where integrated portfolios tend to earn or lose their premium.
What to Watch:
- When do Discover and Contain reach general availability? Cross-platform discovery is the most distinctive part of the story. Watch whether it finds agents on other platforms reliably, or only through a handful of connectors.
- Does Vault become the way in? IBM’s installed base in secrets management is an advantage not every agent identity vendor has, but it sits largely with platform teams. Watch whether security teams adopt Agent Identity through Vault.
- Does runtime authorization reach beyond IBM-governed systems? Agents act inside third-party enterprise applications too. Watch for policy checks that follow an agent there, not only within the systems IBM controls.
- Which registry becomes the source of truth? Vault, Verify, and Orchestrate each track agents today. Watch whether IBM consolidates them, and how it packages and prices the combined architecture.
- How do the other identity camps respond on credentials? Identity platforms and security platforms are moving quickly on agents. Watch how they position their own secrets and credential offerings against Vault’s installed base.
For more information, read the full announcement from IBM. Read the IBM Agent Identity general availability announcement.
Declaration of generative AI and AI-assisted technologies in the writing process: This content has been generated with the support of artificial intelligence technologies. Due to the fast pace of content creation and the continuous evolution of data and information, The Futurum Group and its analysts strive to ensure the accuracy and factual integrity of the information presented. However, the opinions and interpretations expressed in this content reflect those of the individual author/analyst. The Futurum Group makes no guarantees regarding the completeness, accuracy, or reliability of any information contained herein. Readers are encouraged to verify facts independently and consult relevant sources for further clarification.
Disclosure: Futurum is a research and advisory firm that engages or has engaged in research, analysis, and advisory services with many technology companies, including those mentioned in this article. The author does not hold any equity positions with any company mentioned in this article.
Analysis and opinions expressed herein are specific to the analyst individually and data and other information that might have been provided for validation, not those of Futurum as a whole.
Read the full Futurum Group Disclosure.
Other Insights From Futurum:
IBM Q3 FY 2026: Software Growth and Deal Recovery Lift Execution
Where AI Delivers Real ROI: AI-First Integration and Orchestration
Anderon Finalizes $1 Billion CHIPS Award. Who Buys Quantum Wafers Besides IBM?
Author Information
Fernando Montenegro serves as the Vice President & Practice Lead for Cybersecurity & Resilience at The Futurum Group. In this role, he leads the development and execution of the Cybersecurity research agenda, working closely with the team to drive the practice's growth. His research focuses on addressing critical topics in modern cybersecurity. These include the multifaceted role of AI in cybersecurity, strategies for managing an ever-expanding attack surface, and the evolution of cybersecurity architectures toward more platform-oriented solutions.
Before joining The Futurum Group, Fernando held senior industry analyst roles at Omdia, S&P Global, and 451 Research. His career also includes diverse roles in customer support, security, IT operations, professional services, and sales engineering. He has worked with pioneering Internet Service Providers, established security vendors, and startups across North and South America.
Fernando holds a Bachelor’s degree in Computer Science from Universidade Federal do Rio Grande do Sul in Brazil and various industry certifications. Although he is originally from Brazil, he has been based in Toronto, Canada, for many years.
