At the 2026 TechXchange conference in Atlanta, IBM unveiled a suite of new capabilities designed to bring governance, security, and accountability to the rapidly expanding world of AI agents. As enterprises increasingly deploy autonomous agents to handle complex business tasks, organizations face significant challenges regarding "agent sprawl," with many firms lacking the necessary infrastructure to track or secure these non-human workers.

According to Gartner, the average Fortune 500 company is projected to utilize over 150,000 AI agents by 2028. However, current data suggests that only 13% of organizations feel confident in their existing governance frameworks. IBM’s latest announcement aims to bridge this gap by integrating agent discovery, verified identity, and granular access controls into a unified operating model.

Securing Non-Human Identities with HashiCorp Vault

A core component of IBM’s strategy involves extending the capabilities of HashiCorp Vault to the realm of AI. Traditionally used to manage secrets and credentials for human-led applications, Vault will now provide AI agents with verified, short-lived credentials. By automating the rotation of these credentials and ensuring they expire after a set duration, IBM aims to minimize the risk of exposed or overprivileged access.

This approach treats AI agents as a distinct class of non-human identity. Through the new "Agent Identity" feature, organizations can maintain an authoritative record for every agent, documenting ownership, lifecycle status, and granted authority. This framework enforces the principle of least-privilege, ensuring that if an agent attempts to perform an action outside of its defined scope, the system can deny access and revoke the session in real time.

Centralized Discovery and Orchestration

Beyond securing individual credentials, IBM is addressing the challenge of visibility. Because agents are often built across various platforms and clouds, IT teams frequently struggle to maintain a comprehensive inventory. IBM watsonx Orchestrate is being positioned as a central hub for this purpose, allowing organizations to discover, evaluate, and govern agents regardless of their origin.

When paired with Vault’s credential controls, watsonx Orchestrate enables teams to:

  • Audit Actions: Maintain a clear trail of what each agent has done across business systems.
  • Enforce Governance: Define specific job functions for agents and limit their access accordingly.
  • Rapid Response: Revoke trust and credentials instantly if an agent’s behavior deviates from established security policies.

System Intelligence and Infrastructure Management

To further support enterprise-wide AI integration, IBM introduced the Integration Intelligence Hub and IBM Z Atlas. The Integration Intelligence Hub utilizes a Unified Context Engine to help agents understand existing system connections and API dependencies, allowing them to make more informed decisions when troubleshooting or automating tasks.

For organizations operating on IBM Z, the new Z Atlas tool—currently in public preview—maps the entire z/OS stack. By visualizing how infrastructure, middleware, and applications interact, Z Atlas helps teams validate changes before they are implemented. This proactive approach is designed to reduce the risk of unplanned outages, which are often caused by unverified changes in complex environments.

These announcements represent a broader shift in IBM’s enterprise strategy, focusing on an operating model that integrates agents, data, automation, and hybrid infrastructure. While several tools are now generally available, including HashiCorp Vault 2.2 and IBM Concert, others like the Integration Intelligence Hub remain in tech preview as IBM continues to refine its approach to securing frontier intelligence.