Enterprises are building identity and control planes for AI agents

Agents need credentials, not just prompts

IBM has introduced identity and control capabilities for AI agents aimed at developers, IT teams and security teams, with the stated goal of putting agents to work with clear authority and accountability. Its Agent Identity creates an authoritative record for each agent, covering ownership, lifecycle status and granted authority, while HashiCorp Vault extends credential management to agents by issuing secured, short-lived credentials. m:…4502

The company frames the gap in stark terms, citing Gartner for a prediction that by 2028 the average Fortune 500 enterprise will use over 150,000 AI agents, and for a finding that only 13 percent of organizations believe they have the right agent governance in place. This suggests the control problem is not a future concern for most large firms, but a gap that grows with every agent they already run. m:…4502

Control has to follow the agent across platforms

IBM says its watsonx Orchestrate connects to Amazon Bedrock, Microsoft Foundry and Google Gemini to discover agents built in third-party environments, and it includes a kill switch to shut down any agent plus built-in cost tracking for agent model and token use. The company also says the NVIDIA OpenShell runtime integrates with Agent Identity and HashiCorp Vault to secure agent execution environments, and that Vault 2.2 incorporates post-quantum encryption for quantum-era threats. m:…4502

Oracle takes the same question down to the database. The company says AI agents generate SQL dynamically and cannot be relied on to enforce end-user authorization for enterprise data, so its Deep Data Security provides a common authorization model for applications and AI agents. In DBRU 23.26.4, declarative SQL policies called data grants define data authorization, data grant filters restrict access based on a user business scope, and grants are additive, meaning the system takes the union of access provided by multiple applicable grants. m:…4048

The same pattern inside data platforms

Snowflake is centralizing multi-account management through an organization account, replacing the legacy ORGADMIN role with a centralized GLOBALORGADMIN role. Its Organization Hub provides a unified dashboard for billing, security and query health across all accounts, and organization users allow for global identity management, with users categorized as either PERSON or SERVICE types. m:…4098

The centralization has clear limits that executives should note. Snowflake says authentication remains configured per account, warehouse creation privileges remain at the account level and are not managed by the organization account, premium views in the organization account incur additional costs based on record processing volume, and the organization account requires Enterprise Edition or higher. The company says it will email customers at least three months before the ORGADMIN role is phased out. m:…4098

Identity must survive every access path

Oracle says APEX 26.2 and ORDS 26.3.0 can propagate end-user identity and authorization context to Oracle AI Database using OAuth 2.0 tokens, and that Deep Data Security maps identity-provider-specific token claims to a consistent set of database attributes. Keycloak is now a validated identity provider for Deep Data Security alongside OCI IAM and Microsoft Entra ID, and SQL macros allow authorization predicates to be defined once and reused across data grants. m:…4048

The company also says ORDS can expose a governed Model Context Protocol endpoint for compatible clients and agent frameworks, and that Unified Audit can record application identity, data roles and end-user context for audited SQL operations. The implication is that an agent identity is only useful if it travels with the request, whether the request arrives through an application, an API or an agent framework, and leaves an audit trail behind it. m:…4048

Availability is uneven, which matters for planning. IBM says HashiCorp Vault 2.2, Agents Identity, watsonx Orchestrate evaluation capabilities, IBM Concert and HashiCorp Terraform policy are generally available, while Secure Hub, the Terraform Developer Portal, the Terraform remote MCP server and IBM Z Atlas are in public preview, and the IBM Integration Intelligence Hub and watsonx Orchestrate discover and contain capabilities are in tech preview. This suggests buyers should separate what they can deploy now from what they can only test, and should check where control still stops at an account or application boundary. m:…4502