An agent that can open a purchase order, restart a production line or close a support ticket needs the same thing a new employee needs on the first morning: an account, a manager and a list of things it is not allowed to do.
IBM began selling that paperwork on Oct. 27, making generally available a product called Agent Identity alongside version 2.2 of HashiCorp Vault. The pair creates an authoritative record for each agent inside a company’s systems, stating which team owns it, what it is permitted to reach, and which actions it may take. With a companion service called Secure Hub, administrators can revoke an agent’s access in real time when it attempts something outside its brief.
That last function is the one worth pricing. Revocation during an action, rather than after an incident review, is the difference between a control and a report.
IBM is not the first to notice the gap. Identity systems were built for people who log in once, work a shift and leave. Service accounts, the closest existing construct, are long-lived shared credentials that are rarely rotated and almost never tied to an owner. When an agent acts on a model’s output, the credential it uses becomes a delegated authority, and delegated authority that nobody can trace is the failure mode security teams have spent two years describing.
The numbers behind the concern are lopsided. CyberArk’s survey of about 2,600 security decision-makers, published last year, found machine identities outnumbering human ones by roughly 82 to 1, with 42% of those identities holding privileged or sensitive access. In the same survey, 88% of respondents said their organization’s definition of a privileged user applied only to humans.
HashiCorp is the reason IBM can sell this as one product. IBM paid $6.4 billion for the company, closing in February 2025, largely for Terraform and Vault. Vault is where enterprises keep secrets and issue short-lived credentials, which makes it the natural place to bind an agent’s access to an identity record: the agent authenticates as itself, receives a credential with a short expiry, and loses everything when the record is revoked. Selling identity without the secrets store would have left the hard half unsolved.
The competition is filling in from several directions. Microsoft has been building agent identities into Entra, its cloud directory, which gives it the advantage of sitting where the corporate sign-in already happens. CyberArk, now part of Palo Alto Networks, sells privileged access for machines and has been extending it toward agents. A group of startups sells discovery first, on the theory that most companies cannot govern what they cannot enumerate, and most companies cannot enumerate.
IBM’s own discovery tooling is the incomplete part. Agent discovery and quarantine inside watsonx Orchestrate, its automation platform, remain in preview. Until those features ship, an enterprise can register the agents it knows about and cannot see the ones built in a business unit on a departmental cloud account, which is where most ungoverned agents live.
Pricing will decide how far this reaches. Identity products are usually sold per identity, and a per-agent meter is reasonable until a company discovers that its agents spawn sub-agents, each of which needs a credential. The vendors that win this category will be the ones that price at the workflow rather than at the token, because a finance team that deploys four agents and gets a bill for four hundred does not deploy the fifth.
Regulation is pushing the same direction. The European Union’s AI Act imposes logging, human oversight and record-keeping duties on high-risk systems, with the main obligations phasing in from August 2026. Auditors asking who authorized an action will not accept “the model decided” as an answer, and an identity record is the artifact that survives the question. In the United States, incident disclosure rules have made the timeline from detection to filing a board-level concern, which raises the value of being able to say precisely which credential did what.
None of this makes agents safe. An identity record is only as good as the enforcement point, and an agent that reaches a system through a hard-coded API key stored in a repository never touches the vault. The control also assumes the agent’s permissions can be described in advance, which is exactly what is hard about a system that plans its own steps: the sequence is not known when the policy is written.
That is the honest limit of the product, and IBM is selling it anyway, as a separate line with its own price. The bet is that enterprises will accept coarse controls now rather than wait for fine-grained ones, because the alternative is a fleet of agents with standing access to systems that matter, and an audit committee that will eventually ask how that happened.
The company’s framing is that agents need to earn trust the way employees do, with a scope, a supervisor and a way to be shut off. The comparison is imperfect, since an employee cannot be cloned four hundred times overnight, which is precisely the property that makes governance urgent. But the shape of the answer is right, and it is being sold before it is complete, which is how most enterprise security categories begin.
