Key Points
- IBM announces identity and access controls for AI agents at TechXchange 2026
- HashiCorp Vault extended to issue short-lived credentials limiting agent permissions
- Gartner projects Fortune 500 firms will average 150,000 AI agents by 2028
IBM has announced new capabilities to help enterprises manage AI agents, the autonomous software systems that can perform tasks across business applications, with verified identities, access controls and performance tracking.
The technology services company unveiled the tools at its TechXchange 2026 conference in Atlanta, extending its HashiCorp Vault platform to issue secure credentials for AI agents and launching features in its watsonx Orchestrate platform to discover and govern agents across multiple cloud environments, the company said.
AI agents differ from traditional software applications in that they can make decisions, invoke other tools and take actions across systems without continuous human oversight. As enterprises deploy more of these autonomous systems, controlling what they can access and tracing their actions has become a growing concern for security and compliance teams.
According to research firm Gartner, the average Fortune 500 enterprise will use more than 150,000 AI agents by 2028. However, only 13 per cent of organisations believe they have adequate AI agent governance in place, the company said, citing the research.
Agent identity and credentials
HashiCorp Vault, a platform that manages the passwords, keys and credentials that applications use to access business systems, will now extend these capabilities to AI agents. The platform issues short-lived credentials, meaning access permissions that automatically expire after a set period rather than remaining valid indefinitely, the company said.
A new Agent Identity feature establishes an authoritative record for each agent, including who owns it, its operational status and what authority it has been granted. When an agent attempts an action outside its approved permissions, the system can deny access and revoke the session in real time, according to IBM.
“For agents to take on real work across the systems a company depends on, it requires an AI operating model, one that connects agents to the business’s data, applications and infrastructure and runs them with the same discipline as its most critical systems,” said Dinesh Nirmal, senior vice president, IBM Software.
HashiCorp Vault 2.2, now available, gives agents their own secured accounts with automatic credential renewal and incorporates post-quantum encryption, a form of cryptography designed to resist attacks from future quantum computers, the company said.
Cross-platform agent management
IBM watsonx Orchestrate has been updated to work across multiple AI platforms rather than within a single vendor environment. The platform can now connect to Amazon Bedrock, Microsoft Foundry and Google Gemini to discover agents built in those environments, allowing enterprises to maintain visibility over agents regardless of where they were created.
A new containment feature runs agents in isolated sandboxes, meaning separated computing environments where one agent cannot interfere with others. Teams also have access to a kill switch to shut down any agent, according to the company.
The platform includes evaluation tools to test agent quality, accuracy and compliance before deployment and monitor performance in production. Built-in cost tracking shows each agent’s model and token usage, helping teams identify spending patterns.
“Businesses need enforceable control over how agents operate and what they can access,” said John Fanelli, vice president for enterprise software, Nvidia. “Our work with IBM combines Nvidia OpenShell’s policy-governed runtime with Agent Identity and HashiCorp Vault to help enterprises scale AI agents with secure execution, verified identities and tightly scoped access to business systems.”
IBM Concert, which integrates observability and incident management across applications and infrastructure, has been updated to help teams identify vulnerabilities affecting AI agent deployments. The platform uses AI-powered analysis to assess operational impact and coordinate responses, the company said.
HashiCorp Terraform, used for managing infrastructure through code, has received new features including a remote MCP server, a protocol that allows AI agents to interact with external tools and services in a standardised way. These features enable both developers and AI agents to access approved configurations and implement infrastructure changes through established controls.
Shailesh M Shenoy, assistant dean for information technology, Albert Einstein College of Medicine, said his institution was evaluating these tools for biomedical research applications. “Technologies such as IBM Verify and HashiCorp Vault can play an important role in helping organisations establish the identity, access and security controls needed to innovate with confidence,” he said.
IBM also announced IBM Z Atlas for its mainframe customers, which maps an organisation’s entire z/OS stack across infrastructure, middleware and applications, though full details of this capability were not provided in the company’s announcement.
Your Questions, Answered
What are AI agents and why do they need identity management?
AI agents are autonomous software systems that can make decisions and take actions across business applications without continuous human oversight. As enterprises deploy thousands of these agents, they need verified identities and access controls to trace actions and prevent security breaches.
How does HashiCorp Vault secure AI agents?
HashiCorp Vault issues short-lived credentials to AI agents, meaning access permissions that automatically expire rather than remaining valid indefinitely. The Agent Identity feature records who owns each agent and can revoke access in real time if an agent attempts unauthorised actions.
What is IBM watsonx Orchestrate's role in AI agent management?
IBM watsonx Orchestrate connects to multiple AI platforms including Amazon Bedrock, Microsoft Foundry and Google Gemini to discover and manage agents regardless of where they were built. It provides sandbox isolation, kill switches and cost tracking for deployed agents.
How many AI agents will enterprises use by 2028?
According to Gartner research cited by IBM, the average Fortune 500 enterprise will use more than 150,000 AI agents by 2028. However, only 13 per cent of organisations currently believe they have adequate AI agent governance in place.
