IBM gives AI agents revocable identities

At TechXchange 2026, IBM introduced an enterprise control stack for AI agents. Agent Identity records each agent's owner, lifecycle status and granted authority. HashiCorp Vault issues short-lived credentials, renews them automatically and can deny access and revoke a session when an agent exceeds approved permissions. watsonx Orchestrate can discover agents, models and MCP servers across Amazon Bedrock, Microsoft Foundry and Google Gemini, isolate agents in sandboxes and evaluate quality, compliance and cost. Vault 2.2, Agent Identity and evaluation capabilities are generally available; cross-platform discovery, containment and a kill switch remain in technical preview. IBM cites Gartner forecasting more than 150,000 agents for the average Fortune 500 company by 2028 while only 13% of organizations say governance is ready. That is a forecast, not an observed outcome; buyers still need to test coverage, integration cost and real revocation behavior.