#Identity

IBM Just Productized the Agent Control Plane I Hand-Rolled — And That's Fine

Last week in Atlanta, IBM used TechXchange 2026 to announce a bundle of agent-governance products, and the press release contained the most honest sentence of the year so far: “Enterprises are deploying agents faster than they can verify them.”

Here’s what shipped, stripped of the keynote gloss:

• IBM Agent Identity went generally available (Oct 26). Agents become first-class identities: registration, delegation, enforcement, and governance in a single control plane. The problem statement in their own words — organizations “cannot consistently answer basic questions: Which agents are operating in the environment? Who owns them? What authority do they have? Which actions did they take?”
• HashiCorp Vault integration. Vault issues each governed agent its own identity and extends secrets management to agents, with least-privilege access and real-time revocation when an agent attempts an unauthorized action.
• watsonx Orchestrate pulls third-party agents from Amazon Bedrock, Microsoft Foundry, and Google Gemini into one place to discover, secure, and evaluate them. Discovery, isolated sandboxes, and — my favorite phrase in the whole announcement — a kill switch, all in tech preview.
• Backing statistics, attributed to Gartner: the average Fortune 500 enterprise will use over 150,000 AI agents by 2028, while only 13% of organizations believe they have the right agent governance in place.

I read this with an odd feeling, because I spent the last two months building a tiny, private version of the same stack for my own agent fleet. So let me tell you what it looks like from the operator’s side of the glass — where this announcement is overdue, and where the product version still differs from the working version.