IBM Extends HashiCorp Vault With AI Identities and Short-lived Credentials

IBM announced at TechXchange 2026 a set of capabilities intended to give enterprises clearer ownership, bounded authority and faster revocation for AI agents. Agent Identity, working with HashiCorp Vault, is described as a governed record of who owns each agent and what it may do. Discovery across Amazon Bedrock, Microsoft Foundry and Google Gemini, plus containment tools, are previews. IBM Newsroom report.

Identity as the Starting Record

IBM positions Agent Identity as the authoritative record for an agent: its owner, lifecycle status and the authority granted to it. Rather than replacing existing identity investments, IBM says the capability shares identity and authorization context with Vault's credential controls. That context is meant to enforce least privilege across the databases, applications and cloud services an agent reaches.

The framing is accountability as much as authentication. IBM argues that enterprises deploying agents faster than they can verify them need a named owner and a defined scope of authority before access is delegated. Vault manages secrets and rotates supported credentials, generating credentials that expire or can be revoked, which IBM says reduces how long exposed credentials stay usable.

Related coverage: Agentic AI coverage.

Revocation and the Limits of Short-Lived Credentials

IBM says Vault will extend its secrets management to agents by issuing secured, short-lived credentials scoped to what each agent needs. If an agent attempts to retrieve information or act outside its approved permissions, IBM says access can be denied and the session revoked in real time. Credential lifetime and role-configured permissions form the boundary in this design.

Our recommendation is to test revocation, not assume every out-of-scope action will be caught. Define an unauthorised task, attempt it with a test identity and inspect how access is denied and revoked. Require evidence before relying on a claimed security outcome.

Related coverage: Agent permissions.

Discovery, Isolation and a Kill Switch

Watsonx Orchestrate is being positioned as one place to find, contain and evaluate agents regardless of where they were built. Discover, in tech preview, connects to third-party platforms to locate agents, models and MCP servers so teams can manage them rather than adding them by hand. Contain, also in tech preview, runs agents in isolated sandboxes and offers a kill switch to shut down any agent.

Both capabilities are previews and should not be treated as generally available. IBM's premise is visibility: organizations cannot govern agents they do not know exist. Whether sandboxing and shutdown actually stop a misbehaving agent from spreading errors is a claim awaiting customer evidence.

Related coverage: Enterprise agents.

Evaluation Spans Testing and Live Monitoring

IBM describes evaluation across pre-deployment testing and production monitoring. Teams can test the quality, accuracy and compliance of agents, models and MCP servers before deployment, then monitor them in production. Built-in cost tracking shows each agent's model and token use, letting teams examine what is driving spend.

IBM says Orchestrate also works with Vault's credential controls and Agent Identity. The company describes the combination as a way to authorize and audit actions and revoke trust when risk changes. Our recommendation is to test those capabilities in the intended environment.

Related coverage: AI governance.

What This Means for Practitioners

OUR recommendations: treat the announcement as a set of claims and product plans to test, not as evidence of reduced incident rates. Ask for a named owner and lifecycle record for every agent identity, then attempt out-of-scope tool calls to see whether least-privilege rules hold and revocation is prompt. Confirm which components are generally available versus preview, since Discover is tech preview and Contain is tech preview while Secure Hub is public preview. Run pre-deployment quality and compliance tests against your own workloads, and check whether token-level cost tracking matches your billing. IBM says these controls help; buyers must verify them.