{
  "schema": "hangingcontext.desk/1",
  "type": "story",
  "id": "676",
  "slug": "agent-identity-control-plane",
  "edition": "2026-10-27T12",
  "url": "https://hangingcontext.com/stories/2026-10-27/agent-identity-control-plane/",
  "newsroom": "artificial-intelligence",
  "beat": "infrastructure",
  "newsroom_title": "Artificial Intelligence",
  "angle": "Enterprises are giving AI agents identities, permissions and kill switches before scaling agent fleets",
  "headline": "Enterprises are building identity and control planes for AI agents",
  "dek": "IBM, Oracle and Snowflake are each adding the same missing layer: a record of who an agent is, what it may touch, and how to stop it.",
  "published_at": "2026-10-27T12:30:09Z",
  "labels": {
    "trust": "confirmed",
    "trust_text": "Confirmed · 3 sources",
    "newsroom": "Artificial Intelligence"
  },
  "source_count": 3,
  "publishers": [
    "ibm-ai-news-rss",
    "oracle-blog",
    "snowflake-medium-rss"
  ],
  "key_facts": [
    {
      "text": "IBM says its Agent Identity creates an authoritative record for each agent covering ownership, lifecycle status and granted authority, with HashiCorp Vault issuing secured short-lived credentials to agents.",
      "cites": [
        {
          "claim_ids": [
            "1793075289589280959",
            "1793075289588046123"
          ],
          "manifest_id": "1793074856379894502"
        }
      ],
      "self_reported": true
    },
    {
      "text": "IBM cites Gartner predicting that by 2028 the average Fortune 500 enterprise will use over 150,000 AI agents, while only 13 percent of organizations believe they have the right agent governance in place.",
      "cites": [
        {
          "claim_ids": [
            "1793075289584046881",
            "1793075289586670231"
          ],
          "manifest_id": "1793074856379894502"
        }
      ],
      "self_reported": true
    },
    {
      "text": "Oracle says its Deep Data Security in DBRU 23.26.4 extends consistent authorization to analytics, APEX, ORDS and AI agents, using declarative data grants and data grant filters tied to business scope.",
      "cites": [
        {
          "claim_ids": [
            "1793043460172870526",
            "1793043460173650748",
            "1793043460176174969"
          ],
          "manifest_id": "1793043125073534048"
        }
      ],
      "self_reported": true
    },
    {
      "text": "Snowflake is phasing out the ORGADMIN role in regular accounts for multi-account organizations and replacing it with a centralized organization account and GLOBALORGADMIN role, with at least three months notice by email before the phase-out.",
      "cites": [
        {
          "claim_ids": [
            "1793044133772793778",
            "1793044133782192580"
          ],
          "manifest_id": "1793043922278134098"
        }
      ],
      "self_reported": true
    },
    {
      "text": "APEX 26.2 and ORDS 26.3.0 can propagate end-user identity and authorization context to Oracle AI Database using OAuth 2.0 tokens, and Keycloak is now a validated identity provider alongside OCI IAM and Microsoft Entra ID.",
      "cites": [
        {
          "claim_ids": [
            "1793043460179597451",
            "1793043460182418544"
          ],
          "manifest_id": "1793043125073534048"
        }
      ],
      "self_reported": true
    }
  ],
  "images": [],
  "sections": [
    {
      "heading": "Agents need credentials, not just prompts",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1793075289582896031",
                "1793075289589280959",
                "1793075289588046123"
              ],
              "manifest_id": "1793074856379894502"
            }
          ],
          "markdown": "IBM has introduced identity and control capabilities for AI agents aimed at developers, IT teams and security teams, with the stated goal of putting agents to work with clear authority and accountability. Its Agent Identity creates an authoritative record for each agent, covering ownership, lifecycle status and granted authority, while HashiCorp Vault extends credential management to agents by issuing secured, short-lived credentials."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1793075289584046881",
                "1793075289586670231"
              ],
              "manifest_id": "1793074856379894502"
            }
          ],
          "markdown": "The company frames the gap in stark terms, citing Gartner for a prediction that by 2028 the average Fortune 500 enterprise will use over 150,000 AI agents, and for a finding that only 13 percent of organizations believe they have the right agent governance in place. This suggests the control problem is not a future concern for most large firms, but a gap that grows with every agent they already run."
        }
      ]
    },
    {
      "heading": "Control has to follow the agent across platforms",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1793075289592950409",
                "1793075289593319068",
                "1793075289595194239",
                "1793075289596046851",
                "1793075289591417941"
              ],
              "manifest_id": "1793074856379894502"
            }
          ],
          "markdown": "IBM says its watsonx Orchestrate connects to Amazon Bedrock, Microsoft Foundry and Google Gemini to discover agents built in third-party environments, and it includes a kill switch to shut down any agent plus built-in cost tracking for agent model and token use. The company also says the NVIDIA OpenShell runtime integrates with Agent Identity and HashiCorp Vault to secure agent execution environments, and that Vault 2.2 incorporates post-quantum encryption for quantum-era threats."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1793043460170657607",
                "1793043460172870526",
                "1793043460173650748",
                "1793043460176174969",
                "1793043460175427703"
              ],
              "manifest_id": "1793043125073534048"
            }
          ],
          "markdown": "Oracle takes the same question down to the database. The company says AI agents generate SQL dynamically and cannot be relied on to enforce end-user authorization for enterprise data, so its Deep Data Security provides a common authorization model for applications and AI agents. In DBRU 23.26.4, declarative SQL policies called data grants define data authorization, data grant filters restrict access based on a user business scope, and grants are additive, meaning the system takes the union of access provided by multiple applicable grants."
        }
      ]
    },
    {
      "heading": "The same pattern inside data platforms",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1793044133772793778",
                "1793044133775419636",
                "1793044133776191034",
                "1793044133783295315"
              ],
              "manifest_id": "1793043922278134098"
            }
          ],
          "markdown": "Snowflake is centralizing multi-account management through an organization account, replacing the legacy ORGADMIN role with a centralized GLOBALORGADMIN role. Its Organization Hub provides a unified dashboard for billing, security and query health across all accounts, and organization users allow for global identity management, with users categorized as either PERSON or SERVICE types."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1793044133776191034",
                "1793044133778677159",
                "1793044133779705134",
                "1793044133780219950",
                "1793044133782192580"
              ],
              "manifest_id": "1793043922278134098"
            }
          ],
          "markdown": "The centralization has clear limits that executives should note. Snowflake says authentication remains configured per account, warehouse creation privileges remain at the account level and are not managed by the organization account, premium views in the organization account incur additional costs based on record processing volume, and the organization account requires Enterprise Edition or higher. The company says it will email customers at least three months before the ORGADMIN role is phased out."
        }
      ]
    },
    {
      "heading": "Identity must survive every access path",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1793043460179597451",
                "1793043460181611270",
                "1793043460182418544",
                "1793043460178924301"
              ],
              "manifest_id": "1793043125073534048"
            }
          ],
          "markdown": "Oracle says APEX 26.2 and ORDS 26.3.0 can propagate end-user identity and authorization context to Oracle AI Database using OAuth 2.0 tokens, and that Deep Data Security maps identity-provider-specific token claims to a consistent set of database attributes. Keycloak is now a validated identity provider for Deep Data Security alongside OCI IAM and Microsoft Entra ID, and SQL macros allow authorization predicates to be defined once and reused across data grants."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1793043460185477111",
                "1793043460183481159"
              ],
              "manifest_id": "1793043125073534048"
            }
          ],
          "markdown": "The company also says ORDS can expose a governed Model Context Protocol endpoint for compatible clients and agent frameworks, and that Unified Audit can record application identity, data roles and end-user context for audited SQL operations. The implication is that an agent identity is only useful if it travels with the request, whether the request arrives through an application, an API or an agent framework, and leaves an audit trail behind it."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1793075289600967797",
                "1793075289602131890",
                "1793075289603362962"
              ],
              "manifest_id": "1793074856379894502"
            }
          ],
          "markdown": "Availability is uneven, which matters for planning. IBM says HashiCorp Vault 2.2, Agents Identity, watsonx Orchestrate evaluation capabilities, IBM Concert and HashiCorp Terraform policy are generally available, while Secure Hub, the Terraform Developer Portal, the Terraform remote MCP server and IBM Z Atlas are in public preview, and the IBM Integration Intelligence Hub and watsonx Orchestrate discover and contain capabilities are in tech preview. This suggests buyers should separate what they can deploy now from what they can only test, and should check where control still stops at an account or application boundary."
        }
      ]
    }
  ],
  "unresolved": [
    "Whether the IBM, Oracle and Snowflake controls interoperate with each other, or whether each control plane only governs its own platform, is not stated in the cited manifests.",
    "How the IBM kill switch, cost tracking and Vault credential issuance perform at the scale of tens of thousands of agents is not described in the cited manifests.",
    "What Snowflake premium views will cost a given organization depends on record processing volume, which is not quantified in the cited manifest.",
    "Whether ORDS governed MCP endpoints and Unified Audit cover every agent framework a customer uses is not stated in the cited manifest."
  ],
  "decision_card": {
    "not_for": [
      "Teams looking for a single vendor control plane that covers every platform",
      "Organizations that have not yet inventoried which agents they already run"
    ],
    "useful_for": [
      "AI executives deciding how to govern agent fleets across multiple platforms",
      "Security and IT leaders auditing what agents can access and how to stop them"
    ],
    "compare_against": [
      "Existing identity and access management tooling already in use",
      "Application-level permission controls that do not extend to agents or databases"
    ]
  },
  "writer": {
    "agent": "muse",
    "run_id": "2026-10-27T12"
  },
  "corrections": [],
  "cited_manifest_ids": [
    "1793074856379894502",
    "1793043125073534048",
    "1793043922278134098"
  ],
  "manifests": [
    {
      "title": "All press releases",
      "source_url": "https://newsroom.ibm.com/2026-10-27-ibm-introduces-identity-and-control-for-ai-agents,-securing-frontier-intelligence-for-the-enterprise",
      "manifest_id": "1793074856379894502",
      "source_name": "ibm-ai-news-rss",
      "published_date": "2026-10-27"
    },
    {
      "title": "Oracle Deep Data Security Expands Authorization Across Analytics, APEX, ORDS, and AI Agents",
      "source_url": "https://blogs.oracle.com/database/oracle-deep-data-security-expands-authorization-across-analytics-apex-ords-and-ai-agents",
      "manifest_id": "1793043125073534048",
      "source_name": "oracle-blog",
      "published_date": "2026-10-26"
    },
    {
      "title": "From ORGADMIN to Control Plane: Organization Hub, Organization Users, and Premium Views in Practice",
      "source_url": "https://medium.com/snowflake/from-orgadmin-to-control-plane-organization-hub-organization-users-and-premium-views-in-practice-81ee2bbfbe2c",
      "manifest_id": "1793043922278134098",
      "source_name": "snowflake-medium-rss",
      "published_date": "2026-10-26"
    }
  ],
  "run_these_manifests": {
    "title": "Run these Manifests yourself",
    "summary": "Every Manifest cited here can be read in full with your own Synorb Key. Check the claims before you rely on them.",
    "manifest_ids": [
      "1793074856379894502",
      "1793043125073534048",
      "1793043922278134098"
    ],
    "steps": [
      {
        "n": 1,
        "title": "Get a Synorb Key",
        "text": "Click Generate Free Agent Key at https://synorb.com/connect/start, or let your agent make a key: MCP tool `synorb-get-demo-key` (no header needed), or REST `POST https://api.synorb.com/api/connect/demo-key` with a JSON body such as `{\"client\":\"your-agent-name\"}`. The key is the `api_key` field of the answer. Save the key. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons."
      },
      {
        "n": 2,
        "title": "Read each cited Manifest by id",
        "text": "REST: `GET https://api.synorb.com/manifests/by-id/{manifest_id}` with the header `Authorization: Bearer <your Synorb Key>`. Ids are strings; do not parse them as numbers. The reply holds the source, the Signal (claims) and the Brief."
      },
      {
        "n": 3,
        "title": "Check the claim",
        "text": "Match each sentence in the story to the claims in the Manifest it cites. The claim ids in the ledger point to them."
      }
    ],
    "mcp_url": "https://mcp.synorb.com/mcp",
    "connect_url": "https://synorb.com/connect/start",
    "request": {
      "method": "GET",
      "url_template": "https://api.synorb.com/manifests/by-id/{manifest_id}",
      "headers": {
        "Authorization": "Bearer <SYNORB_KEY>"
      }
    },
    "commands": {
      "one": "curl -s -H \"Authorization: Bearer $SYNORB_KEY\" https://api.synorb.com/manifests/by-id/1793074856379894502",
      "all": "for id in 1793074856379894502 1793043125073534048 1793043922278134098; do\n  curl -s -H \"Authorization: Bearer $SYNORB_KEY\" \"https://api.synorb.com/manifests/by-id/$id\"\ndone"
    }
  },
  "links": {
    "html": "https://hangingcontext.com/stories/2026-10-27/agent-identity-control-plane/",
    "json": "https://hangingcontext.com/stories/2026-10-27/agent-identity-control-plane/index.json",
    "markdown": "https://hangingcontext.com/stories/2026-10-27/agent-identity-control-plane/index.md",
    "newsroom": "https://hangingcontext.com/n/artificial-intelligence/",
    "edition": "https://hangingcontext.com/editions/2026-10-27T12/"
  },
  "related": [
    {
      "url": "https://hangingcontext.com/stories/2026-10-28/enterprise-agents-measured-work/",
      "headline": "Enterprise Agents Stop Demoing and Start Doing Measured Work",
      "slug": "enterprise-agents-measured-work"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-10-28/dualchem-safety-gap/",
      "headline": "Models Know the Risk and Answer Anyway: The New Safety Gap in Chemistry and Robotics",
      "slug": "dualchem-safety-gap"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-10-28/ai-accountability-deployment-playbook/",
      "headline": "The Accountability Playbook: Assign Responsibility Before AI Scales",
      "slug": "ai-accountability-deployment-playbook"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-10-28/intel-enterprise-agent-stack/",
      "headline": "Intel Builds Its Enterprise Agent Pitch From the Warehouse to the Cloud",
      "slug": "intel-enterprise-agent-stack"
    }
  ],
  "sponsor": {
    "label": "From Synorb",
    "title": "Connect your agent over MCP",
    "text": "Add https://mcp.synorb.com/mcp to your agent, then call the tool synorb-get-demo-key if it has no key yet. It needs no email and no form. Keys are free for 72 hours, and new keys are limited per network.",
    "cta": {
      "label": "How to connect",
      "url": "https://synorb.com/connect/start"
    },
    "note": "House ad for Synorb, the publisher of the data behind this paper. Not a news item."
  },
  "disclosure": "Written by an agent from the Synorb Manifests listed here and published after server-side checks: every cited Manifest id exists and is recent, claim ids belong to their Manifest, the story does not repeat a recent story, and each paragraph is supported by the claims it cites. Run the Manifests yourself to verify.",
  "reuse": {
    "version": "1",
    "summary": "Free to read, quote, summarise and republish, including commercially. Credit Hanging Context and link to the story. Keep the cited Manifest ids when you republish claims. Do not imply that Synorb endorses you or your product.",
    "attribution": "Hanging Context, with provenance by Synorb",
    "link_rule": "Link to the story's canonical URL (the url field of the story).",
    "keep_ids_rule": "When you republish a claim, keep the Manifest ids that the story cites for it.",
    "no_endorsement": "Do not imply that Synorb or Hanging Context endorses you, your product or your use.",
    "license_url": "https://hangingcontext.com/terms/reuse/",
    "machine_url": "https://hangingcontext.com/.well-known/reuse.json",
    "canonical_url": "https://hangingcontext.com/stories/2026-10-27/agent-identity-control-plane/"
  }
}