IBM Gives AI Agents Verified Identities and a Kill Switch
· Cortex Solutions
On Oct 27 IBM unveiled Agent Identity, Vault 2.2 and watsonx Orchestrate tools to control enterprise AI agents. What launched, the caveats, and lessons for Saudi firms.
On October 27, 2026, at its TechXchange 2026 conference in Atlanta, IBM announced a set of tools aimed at a problem that is starting to worry IT leaders: AI agents that log into systems, use passwords and permissions, and carry out tasks on behalf of employees, while nobody knows exactly who owns each agent, what it is allowed to do, or how to stop it if it oversteps.
The announcement was published in IBM's official newsroom. Techzine Global covered it the same day in a report by Berry Zwets, and on October 28 Fernando Montenegro, Vice President and Practice Lead for Cybersecurity & Resilience at research firm Futurum, published an analysis of it.
Why now?
IBM's release cites a Gartner projection that by 2028 the average Fortune 500 enterprise will use more than 150,000 AI agents. IBM also states that only 13% of organizations believe they have the right AI agent governance in place. Put simply, agents are multiplying faster than companies can control them.
What did IBM announce?
According to IBM, the package rests on three pillars: a verified identity for every agent, short-lived access credentials, and tools to discover, contain and evaluate agents.
- Agent Identity: the authoritative record for each agent, covering its owner, lifecycle status and granted authority. It shares this context with HashiCorp Vault to enforce least-privilege access and to revoke access in real time when an agent attempts an unauthorized action. Techzine explains that in that case access is denied and the session is terminated.
- HashiCorp Vault for agents: Vault issues short-lived credentials that limit each agent to the systems it needs. Vault 2.2 gives agents their own secured accounts, renews their credentials automatically and adds post-quantum encryption.
- Secure Hub: a central view of Vault environments covering operational health, usage and security resources, now in public preview.
- watsonx Orchestrate: works across multiple AI platforms, including Amazon Bedrock, Microsoft Foundry and Google Gemini. IBM added three capabilities: Discover, which finds agents built in other environments along with models and MCP servers; Contain, which runs agents in isolated sandboxes with a "kill switch" to shut down any agent; and Evaluate, which tests agents and models for quality, accuracy and compliance before deployment, then monitors them in production and tracks cost by model and token use.
IBM also announced that Agent Identity and Vault integrate with NVIDIA OpenShell, a secure runtime for agents. The release quotes John Fanelli, Vice President of Enterprise Software at NVIDIA: "Businesses need enforceable control over how agents operate and what they can access."
Dinesh Nirmal, Senior Vice President of IBM Software, said: "The winners in enterprise AI are changing how their business runs, not simply adding more AI to it."
What is available now, and what is still experimental?
IBM's release clearly separates availability levels:
- Generally available: Vault 2.2, Agent Identity, watsonx Orchestrate Evaluate, IBM Concert and Terraform policy.
- Public preview: Secure Hub, the Terraform Developer Portal, the Terraform remote MCP server and IBM Z Atlas.
- Tech preview: Discover, Contain and IBM Integration Intelligence Hub.
In other words, the kill switch, sandboxing and cross-platform agent discovery are still at an early experimental stage.
The analyst view: an important step, but the hardest problem remains
Fernando Montenegro of Futurum sees the credential layer as a practical strength and Vault's large installed base as an advantage for IBM. But he notes that "runtime authorization remains the harder problem for the whole category." In his view, registration, ownership, delegation and short-lived tokens are becoming "expected features", while making sure an agent's actions actually stay within its delegated scope is still an open question, especially for unanticipated actions such as those triggered by prompt injection, because the policy checks as described rely on rules written in advance.
He adds that Discover and Contain are in preview, so the cross-platform promise is for now "a direction more than a finished capability." He also points out that IBM now has three places that track agents (Vault, Verify and Orchestrate), and it is unclear which is the source of truth. He considers Contain's sandboxing more important than the kill switch itself.
What does this mean for Saudi businesses?
Even if your company does not use IBM products, the announcement outlines what will be expected of any business running AI agents:
- Treat every agent like a digital employee: a clear owner on your team, defined permissions and a record of what it did. An agent that answers customers on WhatsApp does not need permission to change prices or view payroll.
- Do not embed permanent passwords in agents: short-lived keys that expire automatically limit the damage if something leaks.
- Prepare a "stop button" and an isolation plan before go-live, not after the first mistake.
- Test the agent before releasing it to customers, and monitor its cost and usage afterwards.
- Do not rely on pre-written rules alone: as analysts warn, controlling an agent's behaviour at runtime remains the biggest challenge, so keep human approval for sensitive actions.
This matters especially in the Kingdom, where the Personal Data Protection Law requires organizations to control who accesses customer data and for what purpose, whether that is a person or an automated agent.
At Cortex Solutions we build AI agents for Saudi businesses that connect to their tools, together with simple controls to manage and adjust them and clear reports on what they have done. Learn more about our AI agents and automation service: https://cortex.sa/services/ai-automation