What shipped. IBM made Agent Identity generally available on Oct. 26 and paired it with HashiCorp Vault 2.2 at TechXchange in Atlanta this week. Agent Identity registers each AI agent, records who owns it, and tracks what authority a human or team has handed it. Vault then issues the agent short-lived, task-specific credentials, and can cut them off mid-task if the agent reaches for something it wasn’t approved to touch.
IBM cites a Gartner forecast that the average Fortune 500 company will run more than 150,000 AI agents by 2028, and that only 13% of organizations think they have the right agent governance in place today.
Why this matters more than another identity launch. Most of the agent identity talk this year has focused on the front door: single sign-on, consent screens, who approved the agent. That’s the world Okta and Microsoft Entra own.
But agents don’t live at the front door. They live in the plumbing. An agent that updates a database, files a ticket or calls a payment API usually does it with an API key, a token or a database password. Often that secret sits in code or a config file and never expires. If that agent goes off script, the login screen is irrelevant. The key already works.
IBM is betting that the control point is the place that hands out those keys. Its own release says it bluntly: as agents act across systems, their credentials become the security boundary.
The $6.4 billion payoff. This is the clearest case yet for why IBM paid about $6.4 billion for HashiCorp, a deal it closed in February 2025. Vault already manages secrets for non-human identities, meaning apps and services, at companies IBM names as ABN AMRO, Adobe, BlackRock, Starbucks and Target. AI agents are just the newest, noisiest kind of non-human identity. IBM doesn’t need to win a new budget line. It needs Vault customers to point their agents at a system they already run.
And IBM isn’t trying to replace the login vendors. HashiCorp’s docs tell teams to start from whatever identity provider they already use, whether Auth0, IBM Verify, Microsoft Entra or Okta. The pitch is coexistence: let them own the human login, and let Vault own the keys the agent actually uses.
What’s real versus what’s preview. Be precise here. Agent Identity, Vault 2.2 and the watsonx Orchestrate testing features are generally available. The ability to discover agents built on Amazon Bedrock, Microsoft Foundry and Google Gemini is a tech preview. So is the sandbox and kill switch that contains a rogue agent. The flashiest part, finding every agent you didn’t know you had, isn’t GA yet.
Vault 2.2 also tackles an old problem called secret zero. That’s the first credential a workload needs just to ask for other credentials. Someone has to hide it somewhere. Vault 2.2 lets Linux virtual machines prove who they are with a virtual TPM, a tamper-resistant chip emulated by the hypervisor, instead of a planted bootstrap secret.
The competitive read. Identity vendors want to own agent identity from the login out. Secrets vendors want to own it from the credential in. Startups are pitching agent governance as a new category in between. IBM is the first big vendor to ship a story that makes the secret the anchor, with an installed base already in production.
The weak spot is reach. Vault is strongest in platform engineering teams, not in the business units spinning up agents in SaaS tools. If an agent lives inside a vendor’s cloud and authenticates with that vendor’s own tokens, Vault may never see it. That’s exactly why the discovery preview matters, and why it’s the piece to watch.
What a buyer should do this quarter. Skip the agent count. Count the long-lived keys your agents use, and who can revoke them. Then ask every vendor pitching agent security one question: if an agent goes rogue halfway through a task, how many seconds until its credentials stop working? The vendor with a real number is selling a control. The rest are selling a dashboard.