IBM Ships Agent Identity, Previews AI Kill Switch

IBM has made a set of tools for governing AI agents generally available, giving each agent a registered identity, an owner and short-lived credentials that can be cut off mid-task. The most eye-catching piece, a kill switch to shut down any agent, is part of a separate feature that IBM still lists as a tech preview.

The announcement on 27 October, made at IBM’s TechXchange conference, pulls together IBM Agent Identity, HashiCorp Vault 2.2 and new controls in watsonx Orchestrate, IBM’s platform for building and managing agents.

In brief

Generally available now: IBM Agent Identity, HashiCorp Vault 2.2 and Orchestrate’s agent testing and cost tracking.
Tech preview only: Orchestrate’s “discover” feature, which finds agents on other platforms, and “contain”, which adds sandboxes and the kill switch.
Vault 2.2 gives agents their own secured accounts and adds post-quantum encryption, IBM says.
IBM cites Gartner figures suggesting the average Fortune 500 company will run more than 150,000 agents by 2028.

Agent Identity and Vault 2.2 are on general release

IBM’s pitch is that agents should be treated like staff accounts, not like scripts with a stored password. According to IBM’s product page for Agent Identity, dated 26 October, the service registers agents in a central inventory, records who owns each one and what tools it is approved to use, and tracks its lifecycle. When an agent acts for a person, it keeps an “on-behalf-of” chain so an action can be traced back to the human or system that started it. Access is granted through OAuth tokens that are short-lived and scoped to a single task, and audit trails link the person, the agent, the credentials issued and what happened next.

HashiCorp, now part of IBM, supplies the credentials through Vault. IBM says Vault 2.2 “gives agents their own secured accounts, automatically renews their credentials and incorporates post-quantum encryption for quantum-era threats”. Used together, IBM says, the two products enforce least-privilege access and allow “real-time revocation when an agent attempts an unauthorized action”: the request is denied and the agent’s session is ended. IBM names Vault users including ABN AMRO, Adobe, BBVA, BlackRock, Canva, the London Stock Exchange, Starbucks and Target, though it does not say which, if any, already use it for agents.

Both products also plug into NVIDIA’s OpenShell runtime, which TSN covered last week. “Businesses need enforceable control over how agents operate and what they can access,” said John Fanelli, a vice president for enterprise software at NVIDIA.

The kill switch sits in a tech-preview feature

The controls that sound most like an emergency brake are not yet on general release. IBM’s release splits the new watsonx Orchestrate features into three. “Discover” connects to Amazon Bedrock, Microsoft Foundry and Google Gemini to find agents built on those platforms, along with models and MCP servers. “Contain” runs agents in isolated sandboxes so “a rogue agent can’t interfere with others”, and gives teams “a kill switch to shut down any agent”. “Evaluate” tests agents for quality, accuracy and compliance before deployment and tracks each agent’s model and token spending.

Only evaluate is generally available. Discover and contain are listed as tech preview, a step behind even the public-preview features in the same release. IBM’s Orchestrate update also describes an AI Gateway for third-party agents, a catalogue aligned to OWASP and CoSAI security guidance, and a “Premium Runtime” using hardware-virtualised container isolation, but it gives no availability date for them. A Secure Hub dashboard for Vault is in public preview.

Why the identity layer matters more than the off switch

IBM frames the problem with a forecast it attributes to Gartner: by 2028 the average Fortune 500 company “will use over 150,000 AI agents”, while “only 13% of organizations believe that they have the right AI agent governance in place”. Those are Gartner’s numbers as quoted by IBM; the underlying report is not public.

Even at a fraction of that scale, a kill switch is a last resort. The harder job is knowing which agents exist, who answers for them, and what each can reach, and that is the part IBM is now selling as finished. Short-lived, task-scoped credentials limit the damage a hijacked agent can do before anyone notices, which is why rivals are moving the same way: Workday is buying C1.ai for agent identity, Google is isolating agents in microVMs and Oracle has set out a four-layer AI trust plan for its business apps.

IBM’s advantage is that Vault already sits inside many large companies’ infrastructure. Its gap is that cross-platform discovery and containment, the features that would let one console see and stop agents running on Amazon, Microsoft and Google, are still previews. Until discover and contain reach general release, the kill switch is something customers can trial, not something IBM yet sells as finished.