IBM is giving every AI agent an identity, a short-lived password and a kill switch
The short answer
At TechXchange 2026 IBM announced agent identity and control across HashiCorp Vault and watsonx Orchestrate: each agent gets its own governed identity, short-lived credentials limited to what its job needs, real-time revocation if it acts outside its permissions, sandboxing and a kill switch.
What was announced
Four pieces, all shipping as one story about authority.
Agent identity. Every agent gets a record: who owns it, whether it is live, and what authority it has been granted. That record sits next to the credentials, so the permission and the identity cannot drift apart.
Credential control. HashiCorp Vault now issues short-lived credentials to agents and can revoke a session in real time if the agent tries something outside its approved scope. Vault 2.2 adds per-agent accounts, automatic renewal and post-quantum encryption.
Discovery and containment. watsonx Orchestrate can find agents built on Amazon Bedrock, Microsoft Foundry and Google Gemini, run them in isolated sandboxes, and shut any of them down with a kill switch.
Cost visibility. The same console tracks each agent's model and token use, so the bill can be traced to a specific agent rather than to "AI".
The number behind the launch
Gartner expects the average Fortune 500 company to run more than 150,000 AI agents by 2028. IBM's own line is the more useful one: only 13 percent of organisations believe they have the right agent governance in place.
That gap is the product. Agents are being deployed faster than they can be verified, and the failure mode is always the same: a credential with more access than the task needs, held for longer than the task runs.
Why this is the same story as the bank blocks
Through October, US banks moved to block third party agents from operating inside customer accounts after reports of agents acting outside user instructions. Twenty one agent incidents became public between July and October across the major labs.
Nobody is arguing agents should stop. The argument is about authority: an agent should be able to prove who it is, reach only what its job requires, and lose access the moment it steps outside that line. IBM is selling exactly that, which means the market has moved from "can the agent do it" to "who approved the agent doing it".
What it means if you run agents
If your agent uses one shared API key, you cannot answer the first question an auditor asks. If the key never expires, you cannot revoke it without breaking the whole workflow. If you cannot see the agent in a list, you cannot prove it exists at all.
Start with one agent, one identity, one scope, and a revocation path you have actually tested. That is the whole checklist, and it is cheaper than the enterprise suite.
Questions people ask
Is this a new product or a rename?
Both. Agent Identity and Vault 2.2 are generally available; discovery, sandboxing and the integration hub are in tech preview.
Do small teams need this?
The enterprise tooling, no. The pattern, yes: one identity per agent, short-lived credentials, least privilege, a way to revoke.
Does it fix prompt injection?
No. It limits the damage. If an agent is tricked, a narrow scope and a short credential life mean the trick reaches less.
Read next: how to give an agent its own identity and why banks blocked third party agents.