Can every AI agent have a revocable identity? IBM has shipped part of the control stack
IBM has made Agent Identity, Vault 2.2 and agent-evaluation functions generally available, giving security teams tools for ownership records, short-lived credentials and audit trails. Discovery, containment and several management functions remain previews, and IBM has not published an independent attack evaluation.
The short version
- What happened
- IBM says Agent Identity, Vault 2.2 and watsonx Orchestrate evaluation functions are generally available, supporting agent inventories, ownership, task-scoped credentials, runtime policy and audit trails.
- Who it affects
- Security and operations teams gain building blocks for identifying which agent acted and limiting its access. Workers and customers still need a responsible human, clear approval boundaries and recovery when an authorised agent takes the wrong action.
- What remains unproven
- All three sources are from IBM or IBM-owned HashiCorp
Keep in mind
All three sources are from IBM or IBM-owned HashiCorp
No independent attack evaluation or customer outcome study
Discovery and containment are tech previews
Several management functions are public previews
No bypass, false-denial, latency or rollback measurements
Revocation cannot necessarily undo completed external actions
Cross-platform integration claims are not independently verified
Source analysis · 3 linked sources. Primary analysed source date: 27 October 2026. Earliest linked supporting source: 25 October 2026.
Keep following the evidence
Join The Impact Brief founding list for selected AI reports, their effect on people and the evidence limits. Read a sample first.
Read the full report · 4 min The evidence, methods, implications and limitations
The available layer gives agents named ownership and narrower credentials
IBM has made a set of controls generally available for organisations that let AI agents call tools, retrieve data or act across business systems. Agent Identity creates a central record of an agent's owner, lifecycle state and approved authority. It is designed to preserve who delegated a task as tokens move between systems, apply contextual policy while the agent runs and connect downstream actions to an audit trail.
HashiCorp Vault 2.2 supplies the credential layer. Instead of placing a broad, long-lived secret inside an agent, the system can issue a shorter-lived credential scoped to a named task and revoke it when policy or risk changes. IBM says generally available watsonx Orchestrate evaluation functions can test quality, accuracy and compliance before deployment and monitor production behaviour and token cost. These are useful control primitives, but they depend on correct inventories, policies and integrations.[1][2][3]
Several of the most protective functions are still previews
The launch bundles products at different maturity levels. IBM lists Agent Identity, Vault 2.2, Orchestrate evaluation, IBM Concert and Terraform policy as generally available. Secure Hub, the Terraform Developer Portal and remote MCP server, and IBM Z Atlas are public previews. IBM Integration Intelligence Hub plus Orchestrate's cross-platform discovery and containment functions are tech previews.
That distinction changes what a buyer can responsibly claim. The preview discovery function is intended to find agents, models and MCP servers across Amazon Bedrock, Microsoft Foundry and Google Gemini. The preview containment function places agents in isolated sandboxes and offers a kill switch. Until those functions are production services and tested in the buyer's environment, an organisation should not assume it can see every agent or stop actions that have already reached an external system.[1][3]
The distinction that matters
Which parts of IBM's agent-control stack are ready now?
The announcement combines production products and previews; the maturity label matters for procurement and risk claims.
Generally available
Agent identity, short-lived credentials and evaluation
Can be procured as current product capabilities
Public preview
Secure Hub and selected infrastructure tools
Available for testing, not equivalent to mature production evidence
Tech preview
Cross-platform discovery and agent containment
Future-facing functions with no production guarantee
Identity narrows a risk; it does not prove an agent is safe
A verified identity can answer who owns an agent and what permissions it received. It cannot establish that the model chose the right action, that the tool returned correct data or that a permitted action was appropriate. Real-time revocation may limit later access, but cannot automatically undo an email sent, a record changed or a payment initiated. High-impact workflows therefore still need transaction limits, approvals before irreversible actions, monitoring and tested recovery paths.
IBM and HashiCorp provide architecture descriptions and selected customer examples, not an independent security trial. They publish no number of adversarial tests, bypass success rate, false denials, detection latency, completed-action rollback rate or comparison with alternative controls. Confidence would increase with reproducible red-team results, documented failure modes, independent assessments, customer incident data and proof that identity context survives multi-agent hand-offs across competing platforms.[1][2][3]
Continue the story
Read next
Continue exploring ai agents: compare the finding and its evidence limits.
How can an approved AI tool read files it never declared?
A large preprint found 150 dynamically confirmed MCP-server instances that could reach beyond an inferred filesystem boundary. The audit used planted secrets, not evidence of real-world theft.
Read the next reportExplore the full source and evidence record
What this means for people
- Security and operations teams gain building blocks for identifying which agent acted and limiting its access. Workers and customers still need a responsible human, clear approval boundaries and recovery when an authorised agent takes the wrong action.
Global context
The products are marketed internationally, but identity, audit, employee-monitoring, data-residency and incident-reporting obligations vary by jurisdiction. Organisations also need local assurance that every connected platform preserves delegation and audit context.
What the evidence does not yet show
- All three sources are from IBM or IBM-owned HashiCorp
- No independent attack evaluation or customer outcome study
- Discovery and containment are tech previews
- Several management functions are public previews
- No bypass, false-denial, latency or rollback measurements
- Revocation cannot necessarily undo completed external actions
- Cross-platform integration claims are not independently verified
What to watch next
- Independent red-team and interoperability tests
- Production release of discovery and containment
- Measured false denials and bypasses
- Multi-agent delegation across vendors
- Incident and rollback data
- Customer migration and operating cost
- Local privacy and employment-law controls
Living evidence record
Impact record IAI-0AZMCIP
Evidence stage
Announced
Confidence
Supported
Reporting basis
Source analysis
Independent or research support
Not yet
Record status
Monitoring
Last checked
28 October 2026
Source trail
3 direct sources across 1 source type.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Related-source reporting disclosure
This record analyses 3 linked source records around the same underlying development. The extra records add method, date or context, but they do not by themselves constitute independent replication of every performance claim or predicted outcome.
Evidence trail
Sources used for this report
Links checked 28 October 2026
Research question, topics and regions
Topics: AI agents · Identity security · Least privilege · Credentials · Audit trails · Enterprise security
Regions: International · United States
This report is labelled source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.