ATLANTA – October 28, 2026 -- IBM is extending HashiCorp Vault to AI agents, issuing each one a governed identity and short-lived credentials, as Gartner data shows only 13% of organizations believe they have the right agent governance in place. The company announced the capabilities at TechXchange 2026.
Gartner projects that by 2028 the average Fortune 500 enterprise will use more than 150,000 AI agents. IBM cites persistent credentials, unclear ownership and disconnected controls as the main obstacles to governing agents that call tools and act across teams, platforms and clouds.
Agent Identity ties each agent to an owner, a lifecycle status and defined authority
Used with Vault, Agent Identity keeps an authoritative record of who owns each agent, its lifecycle status and the authority it has been granted. It passes that context to Vault's credential controls, which enforce least-privilege access. If an agent attempts an unauthorized action, access can be denied and the session revoked in real time.
HashiCorp Vault already secures non-human identities at organizations including ABN AMRO, Adobe, BBVA, BlackRock, London Stock Exchange, Starbucks and Target, according to IBM.
Vault 2.2 gives agents their own secured accounts and adds post-quantum encryption
Vault 2.2 also renews agent credentials automatically. Secure Hub, now in public preview, gives companies centralized visibility into the operational health, usage and security resources of their Vault environments.
Watsonx Orchestrate adds discovery, containment and evaluation across rival platforms
IBM watsonx Orchestrate is designed to work across the AI ecosystem rather than inside a single vendor's platform. It adds three capabilities:
- Discover (tech preview): connects to Amazon Bedrock, Microsoft Foundry and Google Gemini to find agents built in third-party environments, so teams no longer add them manually. It also covers models and MCP servers.
- Contain (tech preview): runs agents in isolated sandboxes so a rogue agent cannot interfere with others, and adds a kill switch to shut down any agent.
- Evaluate: tests the quality, accuracy and compliance of agents, models and MCP servers before deployment, then monitors them in production. Built-in cost tracking shows each agent's model and token use.
Orchestrate also works with Vault's credential controls and Agent Identity so teams can audit agent actions and revoke credentials quickly when risk changes.
Integration Intelligence Hub gives agents context on existing systems
IBM Integration Intelligence Hub uses a Unified Context Engine to show agents what already exists, how systems connect and what their actions could affect. Agents can then fix problems such as stuck messages or deploy an API using existing assets. Skills, approval policies and audit controls limit what they can do.
Client speakers detail Vault deployments from certificates to AI agent identity
At TechXchange, athenahealth will discuss automating certificate management with Vault's PKI engine. Albert Einstein College of Medicine will present IBM Verify and Vault applied to AI agent identity, just-in-time access, dynamic secrets and auditability. Optum will cover Vault Radar and Boundary. Seven-Eleven Japan will discuss Vault Enterprise and Vault Radar. Yum! Brands will outline an identity security platform built with IBM Verify.
NVIDIA OpenShell integration pairs a protected runtime with verified agent identities
Agent Identity and HashiCorp Vault integrate with NVIDIA OpenShell secure runtime software. Each agent gets a verified identity and short-lived credentials inside a protected environment, so every action can be traced, limited and reviewed. NVIDIA's John Fanelli, vice president of enterprise software, said businesses need "enforceable control over how agents operate and what they can access."