Can every AI agent have a revocable identity? IBM has shipped part of the control stack
IBM has made Agent Identity, Vault 2.2 and agent-evaluation functions generally available, giving security teams tools for ownership records, short-lived credentials and audit trails. Discovery, containment and several management functions remain previews, and IBM has not published an independent attack evaluation.
The short version
- What happened
- IBM says Agent Identity, Vault 2.2 and watsonx Orchestrate evaluation functions are generally available, supporting agent inventories, ownership, task-scoped credentials, runtime policy and audit trails.
- Who it affects
- Security and operations teams gain building blocks for identifying which agent acted and limiting its access. Workers and customers still need a responsible human, clear approval boundaries and recovery when an authorised agent takes the wrong action.
- What remains unproven
- All three sources are from IBM or IBM-owned HashiCorp
Keep in mind
All three sources are from IBM or IBM-owned HashiCorp
No independent attack evaluation or customer outcome study
Discovery and containment are tech previews
Several management functions are public previews
No bypass, false-denial, latency or rollback measurements
Revocation cannot necessarily undo completed external actions
Cross-platform integration claims are not independently verified
Source analysis · 3 linked sources. Primary analysed source date: 27 October 2026. Earliest linked supporting source: 25 October 2026.
Read the full report · 4 min The evidence, methods, implications and limitations
The available layer gives agents named ownership and narrower credentials
IBM has made a set of controls generally available for organisations that let AI agents call tools, retrieve data or act across business systems. Agent Identity creates a central record of an agent's owner, lifecycle state and approved authority. It is designed to preserve who delegated a task as tokens move between systems, apply contextual policy while the agent runs and connect downstream actions to an audit trail.
HashiCorp Vault 2.2 supplies the credential layer. Instead of placing a broad, long-lived secret inside an agent, the system can issue a shorter-lived credential scoped to a named task and revoke it when policy or risk changes. IBM says generally available watsonx Orchestrate evaluation functions can test quality, accuracy and compliance before deployment and monitor production behaviour and token cost. These are useful control primitives, but they depend on correct inventories, policies and integrations.[1][2][3]
Several of the most protective functions are still previews
The launch bundles products at different maturity levels. IBM lists Agent Identity, Vault 2.2, Orchestrate evaluation, IBM Concert and Terraform policy as generally available. Secure Hub, the Terraform Developer Portal and remote MCP server, and IBM Z Atlas are public previews. IBM Integration Intelligence Hub plus Orchestrate's cross-platform discovery and containment functions are tech previews.
That distinction changes what a buyer can responsibly claim. The preview discovery function is intended to find agents, models and MCP servers across Amazon Bedrock, Microsoft Foundry and Google Gemini. The preview containment function places agents in isolated sandboxes and offers a kill switch. Until those functions are production services and tested in the buyer's environment, an organisation should not assume it can see every agent or stop actions that have already reached an external system.[1][3]
The distinction that matters
Which parts of IBM's agent-control stack are ready now?
The announcement combines production products and previews; the maturity label matters for procurement and risk claims.
Generally available
Agent identity, short-lived credentials and evaluation
Can be procured as current product capabilities
Public preview
Secure Hub and selected infrastructure tools
Available for testing, not equivalent to mature production evidence
Tech preview
Cross-platform discovery and agent containment
Future-facing functions with no production guarantee
Identity narrows a risk; it does not prove an agent is safe
A verified identity can answer who owns an agent and what permissions it received. It cannot establish that the model chose the right action, that the tool returned correct data or that a permitted action was appropriate. Real-time revocation may limit later access, but cannot automatically undo an email sent, a record changed or a payment initiated. High-impact workflows therefore still need transaction limits, approvals before irreversible actions, monitoring and tested recovery paths.
IBM and HashiCorp provide architecture descriptions and selected customer examples, not an independent security trial. They publish no number of adversarial tests, bypass success rate, false denials, detection latency, completed-action rollback rate or comparison with alternative controls. Confidence would increase with reproducible red-team results, documented failure modes, independent assessments, customer incident data and proof that identity context survives multi-agent hand-offs across competing platforms.[1][2][3]