IBM has additionally enhanced HashiCorp Vault, enabling the tool to be used inside AI agents and giving administrators the ability to define what privileges those agents hold. With Vault 2.2, we can now take advantage of the Agent Identity integration, which identifies the agent and its lifecycle state, along with the rights and privileges it possesses. Both of these are already available.
To illustrate this, let’s consider an example of an agent designed to debug a particular application. To complete this task, the agent must access the logs, communicate with the database, and change configuration parameters. An administrative login would help get this done; however, it would place too much power in the hands of unreliable software.
This is still not sufficient. Although issuance of temporary credentials helps to reduce the window of time when credentials can be misused, this will do nothing if an agent misuses its permissions. Moreover, the identification of an agent tells us nothing about what the agent will do in the next moment.
Revocation raises its own questions. Cutting access stops new requests, but buyers will want to know what happens to open connections, queued jobs and changes already submitted.
Additionally, IBM associates agents to Terraform processes for approved configurations. On the other hand, watsonx Orchestrate includes discovery of agents in Amazon Bedrock, Microsoft Foundry, and Google Gemini, along with containment and evaluation services. Only evaluation is available today. The other two remain technology previews.
Service providers face a different problem. An agent serving several customers needs limits tied to each contract, so the provider has to keep tenants separate, block permissions from carrying over and keep audit trails. Upkeep costs money too. Someone must manage credential policies and respond when access fails, and that time eats into the labor savings.
A practical test is simple. Give an agent a maintenance task, then add an unauthorized request, let a credential expire and leave one operation half finished. Administrators can then see what the system blocked, what kept running and whether the logs make sense. How much of this works without custom integration is still unclear.
