IBM gives AI agents identities, with new discovery in preview
IBM is putting agent identity, credentials and evaluation into a connected management stack. Its October 27 TechXchange announcement lists Agent Identity, HashiCorp Vault 2.2 and watsonx Orchestrate evaluation as generally available. The new cross-platform discovery and containment capabilities are still technology previews.
That distinction matters for a team deciding what it can deploy. Registering an agent, limiting its access and finding every agent in an organization are different jobs. A release that advances one does not mean the whole proposed management system is finished.
Available controls and preview capabilities
| Capability | Announced status |
|---|---|
| Agent Identity and Vault 2.2 | Generally available |
| Orchestrate evaluation | Generally available |
| New Orchestrate discovery and containment | Technology preview |
IBM describes discovery across Amazon Bedrock, Microsoft Foundry and Google Gemini, including models and MCP servers. Containment adds isolation and a shutdown control. These remain preview capabilities, not a blanket production-availability claim.
An agent’s identity is not its permission
IBM detailed Agent Identity on October 26. It records ownership, approved connections and lifecycle state, then preserves the delegation context behind an action. IBM Verify provides identity and authorization controls. Vault supplies short-lived, target-specific credentials for systems that cannot directly accept delegated tokens.
Consider a hypothetical purchasing assistant asked to compare a supplier catalog with an approved order. Reading the catalog, drafting a suggested change and submitting the order should not be treated as the same permission. The employee who requested the comparison has not necessarily authorized a purchase.
The diagram is an explanatory workflow, not an IBM interface or a test of its products. A meaningful access boundary would let the assistant finish the comparison while reserving submission for the required approval. Naming the assistant makes its activity easier to attribute, but the downstream system still has to enforce the action boundary.
A separate NIST design-tenets post published October 27 makes the architectural distinction explicit: the system that decides what an agent may do should be separate from the reasoning that proposes an action. It also calls for bounded, revocable authorization and traceable delegation. These are proposed design tenets, not a certification of IBM or a guarantee that any configuration meets them.
Evaluation has to examine the tool call
The Orchestrate product announcement describes user simulations, deterministic checks of tool calls and parameters, and a Trace Inspector for following execution. It also includes natural-language criteria for model-based evaluation. Those mechanisms ask different questions: whether an answer looks useful and whether the agent actually called the intended tool with acceptable inputs.
For the purchasing example, a convincing summary would not be enough. A useful test would also inspect which supplier record was read, whether an unapproved order update was refused and whether the trace connects the request to the resulting action. These are illustrative acceptance checks, not results from a ByteForward benchmark.
The next step is proving a bounded workflow
Start the assessment with a task small enough to observe end to end. Check normal completion, a request outside its approved scope and an expired credential. A successful demonstration of one path should not be generalized to every connected application.
The same distinction between model reasoning and surrounding execution appears in our coverage of NVIDIA and Meta’s Muse infrastructure partnership. Faster or more capable reasoning does not remove the need to check what the tools actually did.
IBM has announced product capabilities and release stages, not independent proof of universal protection. The practical question for an enterprise is whether its own identity records, approval rules, credentials and audit trail remain connected through a complete task.
