At TechXchange 2026, IBM made HashiCorp Vault's Agent Identity generally available and extended watsonx Orchestrate to discover, sandbox and evaluate agents built anywhere — an attempt to govern agent sprawl that enterprises can no longer see.
IBM's argument, delivered at its TechXchange 2026 conference in Atlanta, is blunt: enterprises are deploying AI agents faster than they can verify them. The company's answer is not another agent builder but the control layer underneath one — an identity for every agent, credentials that expire quickly and carry only the permissions the job needs, and a single place to see agents that were built somewhere else entirely.
Two pieces do most of that work. HashiCorp Vault's Agent Identity, now generally available, becomes the authoritative record for each agent: who owns it, whether it is active, and what authority it has been granted. IBM watsonx Orchestrate, meanwhile, is being extended to discover agents across Amazon Bedrock, Microsoft Foundry and Google Gemini, run them in isolated sandboxes, and test them before and after deployment.
Agents are a growing class of non-human identity, alongside applications and services, and they break the old security model in a specific way: a long-lived, overprivileged credential given to an agent that later gets compromised — or simply wanders outside its intended task — can put whole systems at risk. Vault already manages secrets and credentials for applications; IBM is now extending the same machinery to agents, issuing secured, short-lived credentials that limit each agent to what it needs.
Agent Identity shares identity and authorization context with Vault's credential controls, so the enforcement is not just a login check at the start. If an agent tries to retrieve information or perform an action outside its approved permissions, access can be denied and the session revoked in real time. Vault 2.2, also generally available, gives agents their own secured accounts, automatically renews their credentials, and adds post-quantum encryption for quantum-era threats.
Identity only helps for agents you know about, and that is the harder problem. Orchestrate's Discover capability, in tech preview, connects to Bedrock, Foundry and Gemini to find agents built in third-party environments, along with models and MCP servers, instead of requiring teams to register each one by hand. Contain, also in tech preview, runs agents in isolated sandboxes so one rogue agent cannot interfere with others — and gives teams a kill switch to shut any agent down.
Evaluate, by contrast, is generally available. Teams can test the quality, accuracy and compliance of agents, models and MCP servers before deployment, monitor them in production, and track what is driving spend through built-in cost tracking of each agent's model and token use. Orchestrate works with Vault's credential controls and Agent Identity, IBM says, so an agent's job, authority and least-privilege access are governed together rather than in three separate tools.
The announcement reaches beyond identity. The IBM Integration Intelligence Hub, in tech preview, gives agents context about a company's existing APIs and systems through a Unified Context Engine, so they can fix problems like stuck messages or deploy an API using what is already in place, with skills, approval policies and audit controls keeping those actions in check. Agent Identity and Vault also integrate with NVIDIA OpenShell's policy-governed runtime, pairing a protected execution environment with verified identity and short-lived credentials.
IBM Concert, generally available, ties observability, incident management and security together to help teams find high-risk vulnerabilities and coordinate fixes, while HashiCorp Terraform policy is generally available for governed infrastructure changes. Secure Hub, the Terraform Developer Portal and remote MCP server, and IBM Z Atlas sit in public preview. Dinesh Nirmal, IBM Software's senior vice president, framed the whole package as an operating model rather than a feature: agents, he said, need to run “with the same discipline as [a company's] most critical systems.”
The numbers IBM leans on explain the timing. Citing Gartner, the company says the average Fortune 500 enterprise will use over 150,000 AI agents by 2028, yet only 13% of organizations believe they have the right AI agent governance in place. Persistent credentials, unclear ownership and disconnected controls are the gap — and every agent added without an owner or an expiry date widens it.
That is also why the most consequential items here may be the ones still in tech preview. Discover and Contain only matter if they actually surface the shadow agents nobody registered and isolate the ones that misbehave; until those graduate, enterprises get the identity record and the evaluation tooling first, and the full cross-platform dragnet second. The question for IT teams is not whether agents need IDs — that part is now settled, at least in IBM's stack — but whether the discovery net catches everything, including the agents their own colleagues built last week and never told anyone about.
The authoritative record for each AI agent when used with HashiCorp Vault: who owns the agent, its lifecycle status, and the authority it has been granted, shared with Vault's credential controls to enforce least-privilege access.
Its Discover capability, in tech preview, connects to Amazon Bedrock, Microsoft Foundry and Google Gemini to find third-party agents, models and MCP servers; Contain, also in tech preview, runs agents in isolated sandboxes with a kill switch; and Evaluate, generally available, tests quality, accuracy and compliance before deployment and monitors agents in production.
Generally available: HashiCorp Vault 2.2, Agent Identity, watsonx Orchestrate's Evaluate capability, IBM Concert, and HashiCorp Terraform policy. In public preview: Secure Hub, the Terraform Developer Portal and remote MCP server, and IBM Z Atlas. In tech preview: the IBM Integration Intelligence Hub and watsonx Orchestrate's Discover and Contain capabilities.