IBM adds identity and access controls for AI agents, with containment still in preview

IBM is connecting the record of who owns an AI agent to controls over what it can do. At TechXchange on October 27, 2026, the company introduced coordinated identity, credential and evaluation capabilities for enterprise agents. Core tools are generally available, while cross-platform discovery and containment remain in tech preview.

The problem starts when an agent acts with a person’s permissions. Tyler Lynch, IBM Automation’s outbound CTO, told a press briefing that business users creating agents are not necessarily security experts. Agents can impersonate those users, leaving companies unsure whether a person or an agent performed a particular action.

Blocking agents presents a different risk. Gartner analyst Max Goss argues that restrictions can push employees toward unsanctioned tools, making agent governance a balance between control and the ability to get work done.

An identity that follows the task

IBM’s response begins with Agent Identity, which it announced as generally available on October 26. The software registers agents in a central inventory, records their owners and lifecycle status, classifies risk and documents approved tool connections. That creates a shared record of each agent and its granted authority.

The next step is preserving whose authority the agent is using. IBM says Agent Identity maintains delegation context across identity providers and token exchanges, allowing actions to be traced to an originating person, approval state or upstream system. Short-lived, task-scoped tokens narrow access at each step, with consent-aware authorization available for sensitive actions.

IBM Verify supplies centralized identity, authorization and audit controls. HashiCorp Vault handles a separate problem: protecting credentials for business systems that cannot accept delegated tokens directly. It can issue credentials for a specific target just when needed, tie them to approved delegation and let them expire rapidly.

Vault already manages application and service credentials through central storage, rotation and dynamically generated access. IBM is extending those controls to agents under least privilege: access limited to what the task requires. The company says an unauthorized request can be denied and the session revoked in real time.

The audit trail connects the human identity, delegated agent, credential issuance, policy decisions and downstream actions. IBM describes that evidence as supporting incident investigations and compliance reporting. Its architecture is designed to coexist with existing identity providers rather than require replacement of workforce identity systems.

Discovery and containment are not yet generally available

The October 27 package also connects identity and credential controls to watsonx Orchestrate. Its three management functions have different release statuses:

• Discover, in tech preview, connects to platforms including Amazon Bedrock, Microsoft Foundry and Google Gemini to find third-party agents without requiring teams to add them manually.
• Contain, also in tech preview, runs agents in isolated sandboxes to prevent interference with other agents. It includes a kill switch for shutting an agent down.
• Evaluate is generally available. Teams can test quality, accuracy and compliance before deployment, monitor agents in production and track model and token usage to identify spending drivers.

IBM also announced that Agent Identity and Vault integrate with NVIDIA’s OpenShell secure runtime. The combination pairs a protected execution environment with verified identities and short-lived credentials, intended to make agent actions traceable, limited and reviewable.

For customers starting now, IBM recommends choosing a known, bounded workflow rather than immediately extending controls everywhere. Its proposed sequence is to register the agent, assign ownership, preserve delegation context, apply authorization during execution, protect credentials and capture the audit trail. Broader coverage follows once that pattern is proven.