网络安全
IBM 带来管理的身份和证书控制到AI Agents
在 Google 上的首选来源中添加 Unite.AI
2026年10月27日IBM，宣布在亚特兰大TechXchange 2026为企业AI agents提供新身份，证书，发现，封装和评价能力，包括一般提供IBM Agent身份和HashiCorp Vault 2.2.
称公司的能力是为开发者、信息技术和安全团队建立，这些团队在业务系统中运行agents，具有明确的权力和问责制，将agent发现、核实身份、访问控制和性能评价结合起来。 “企业AI的赢家正在改变经营方式，Nirmal 称 agents承担了真正的工作，需要一个AI操作模型，将它们与公司的数据，应用和基础设施相连接。
IBM的公告将推出与当前企业部署的治理差距挂钩。 Gartner在2026年4月28日的一份新闻稿中预测，到2028年，全球平均财富500强企业将拥有超过15万agents的使用量，而2025年的不到15个，只有13%的组织认为他们拥有正确的AI agent治理权。 IBM确认，持续的证书、不明确的所有权和断开的控制是新能力目标的障碍。
Agent 身份和桥码
Agent 坐标身份，详见2026年10月26日公布的IBM公告，将agents登记在中央清单中并捕获所有权，元数据，风险分类，被核准的工具连接和生命周期状态。 IBM 称系统在身份提供者和象征性交换之间保留半授权，这样一项行动可以追溯到起源人，批准状态或上游系统，它发布基于OAuth的，短寿命的，任务范围的指示牌，并获得敏感行动的许可。 在agent运行期间，控制仍然有效，包括背景授权、政策执行、运行时间风险评估和证书控制。 结构化的审计线索将人类身份、授权的agent身份、证书发放、政策决定和下游遵守报告和事件调查行动联系起来。
在架构内，IBM验证提供集中身份，授权，治理，信使交换和审计控制，而HashiCorp Vault经纪人则在短时间内为不能直接消耗授权信使的系统提供特定目标证书。 与Vault,IBM 称，Agent身份一同使用，为每个agent建立权威记录，涵盖其所有者，生命周期状态和被授予的权力，并与Vault的证书控制共享该上下文，以强制最低特权进入，并在agent尝试未经授权的行动时允许实时撤销。
IBM 齐克0Z Vault已经为包括ABN AMRO,Adobe,Athenahealth,BBVA,BlackRock,Canva,Duke Energy,Expedia，伦敦证券交易所，星巴克，瑞士联邦铁路和目标公司在内的组织确保非人类身份。 Vault 2.2给予agents自己的安全账户，自动续签其证书并包含量子后加密。 根据HashiCorp对更新的叙述，发布新增 vTPM支持Linux虚拟机，让工作量通过加密验证与注册的虚拟TPM绑定，而不是分配靴子圈秘密，与PKI现代化，自动化公共证书管理以及IBM Power上的Vault同时进行。
两个相关的预览扩展了Vault组合。 安全枢纽在公众预览中，在分布的地窖环境中提供集中的能见度、报告和治理，包括业务健康、秘密和证书。 Vault Arc，同样在公众预览中，推出是一个新的资源和IAM模型，具有范围与平面授权以及agent和非人类身份治理。 HashiCorp Birder 1.1在公开预览中可以使用模型上下文协议服务器，它让管理员以自然语言管理边界集群，让MCP相容的agents在没有自定义客户端代码的情况下到达SSH和RDP目标；同时发布新增应用令牌，并带有定制的时到活和范围，虚拟机器自动从单一插件配置中跨越多个AWS账户。
沃森克管弦乐团的发现、遏制和评价
IBM的Watsonx Orchestrate公告推出是一个AI Gateway，它作为单执行层，用于发现第三方agents，模型和MCP服务器跨越Amazon Bedrock,Microsoft和Google等平台，客户可以通过Watsonx Orchestrate聊天和频道与这些agents互动。 在技术预览中，发现能力与Amazon Bedrock,Microsoft Foundry和Google Gemini等平台相接来寻找在第三方环境中所建的agents，并延伸到了模型和MCP服务器。
Orchestrate目录正在演变成一个与OWASP,CoSAI和IBM AI Risk Atlas一致的受管目录。 对于包括Ziemacs和Cognos Partners在内的所选择的agents，它表面显示性能，可靠性和耐久度度度量度外加欧盟AI Act遵守信息；对于包括Box,Visier和New Relic在内的所选择的MCP服务器，它显示显示协议符合性，工具schema完整性和默认的证书拒绝。
一种同样在技术预览中进行封装的能力，在被隔离的沙盒中运行agents，并给团队一个歼灭开关来关闭任何agent，而Premium Runtime则提供硬件虚拟化的容器隔离，零平移和硬件约束的资源封装。 评价工具一般可用：团队可以在部署agents，模型和MCP服务器前测试其质量，准确性和合规性，并在生产中对其进行监测，同时对模型和符号使用进行内置成本跟踪。 新的工具包括自定义LLM-as-a-Judge评价、用户模拟确定性评价、追踪检查员和调查失败并生成测试案例的AgentOps Agent。 管弦乐团还可以直接与Microsoft Entra和IBM验证连接，作为人类和非人类agent身份的身份提供者。
NVIDIA 整合、提供和会议方案
IBM 称 Agent 身份和HashiCorp Vault与NVIDIA OpenShell安全运行时间软件集成，是NVIDIA OpenShell Architecture的地基，将一个受保护的运行时间环境与每个agent的可验证身份和短寿命证书相配。 NVIDIA的企业软件副总裁约翰·法内利(John Fanelli)，称的作品将OpenShell的政策管理运行时间与Agent身份和Vault结合起来，支持安全执行和严格限定进入商业系统的范围。
关于可用性，HashiCorp站2.2、Agent 身份，watsonx Orchestrate评价能力，IBM Concert和Terraform政策一般都有；安全枢纽，Terraform开发者门户，Terraform远程MCP服务器和IBM Z Atlas在公开预览；IBM整合情报枢纽和Orchestrate发现并包含能力在技术预览。
在会上发言的客户包括：关于用Vault的PKI引擎实现证书管理自动化的Athenahe；关于将IBM验证和Vault应用到agent身份、即时访问、动态秘密和可审计性的Albert Einstein医学院；关于Vault雷达和边界的Optum；关于Vault企业和Vault雷达的7-Eleven Japan；以及Yum！品牌在建设身份安全平台与IBM验证。 阿尔伯特·爱因斯坦医学院信息技术助理院长Shailesh M. Shenoy，称技术如IBM验证和HashiCorp Vault可以帮助各组织建立自信创新所需的身份，访问和安全控制。
IBM 称今年的TechXchange将HashiConf，带来合并为来自85个国家的近6500名参与者，拥有超过1000个课程，180个实践实验室，260个客户主导的课程和50多个认证考试。
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Cybersecurity
IBM Brings Governed Identity and Credential Controls to AI Agents
Add Unite.AI to your preferred sources on Google
IBM on October 27, 2026, announced new identity, credential, discovery, containment and evaluation capabilities for enterprise AI agents at TechXchange 2026 in Atlanta, including the general availability of IBM Agent Identity and HashiCorp Vault 2.2.
The company said the capabilities are built for developers, IT and security teams running agents across business systems with defined authority and accountability, combining agent discovery, verified identities, access controls and performance evaluation. “The winners in enterprise AI are changing how their business runs, not simply adding more AI to it,” Dinesh Nirmal, Senior Vice President of IBM Software, said in IBM’s announcement. Nirmal said agents taking on real work require an AI operating model that connects them to a company’s data, applications and infrastructure.
IBM’s announcement tied the rollout to governance gaps in current enterprise deployments. Gartner predicted in an April 28, 2026 press release that by 2028 an average global Fortune 500 enterprise will have over 150,000 agents in use, up from less than 15 in 2025, and that only 13% of organizations believe they have the right AI agent governance in place. IBM identified persistent credentials, unclear ownership and disconnected controls as the obstacles the new capabilities target.
Agent Identity and HashiCorp Vault
Agent Identity, detailed in an IBM announcement published October 26, 2026, registers agents in a central inventory and captures ownership, metadata, risk classifications, approved tool connections and lifecycle state. IBM said the system preserves on-behalf-of delegation across identity providers and token exchanges so an action can be traced to an originating person, approval state or upstream system, and it issues OAuth-based, short-lived, task-scoped tokens with consent-aware authorization for sensitive actions. Controls remain active while an agent runs, covering contextual authorization, policy enforcement, runtime risk evaluation and credential control. Structured audit trails connect human identity, delegated agent identity, credential issuance, policy decisions and downstream actions for compliance reporting and incident investigation.
Within the architecture, IBM Verify provides centralized identity, authorization, governance, token exchange and audit controls, while HashiCorp Vault brokers just-in-time, target-specific credentials for systems that cannot consume delegated tokens directly. Used with Vault, IBM said, Agent Identity establishes the authoritative record for each agent, covering its owner, lifecycle status and granted authority, and shares that context with Vault’s credential controls to enforce least-privilege access and enable real-time revocation when an agent attempts an unauthorized action.
IBM said Vault already secures non-human identities for organizations including ABN AMRO, Adobe, athenahealth, BBVA, BlackRock, Canva, Duke Energy, Expedia, London Stock Exchange, Starbucks, Swiss Federal Railways and Target. Vault 2.2 gives agents their own secured accounts, automatically renews their credentials and incorporates post-quantum encryption. According to HashiCorp’s account of the updates, the release adds vTPM support for Linux virtual machines, letting workloads authenticate with cryptographic proof tied to an enrolled virtual TPM rather than distributed bootstrap secrets, alongside PKI modernization, automated public certificate management and Vault on IBM Power.
Two related previews extend the Vault portfolio. Secure Hub, in public preview, provides centralized visibility, reporting and governance across distributed Vault environments, including operational health, secrets and certificates. Vault Arc, also in public preview, introduces a new resource and IAM model with scoped and ephemeral authorization and agent and non-human identity governance. HashiCorp Boundary 1.1 is available with a Model Context Protocol server in public preview, which lets administrators manage Boundary clusters in natural language and lets MCP-compatible agents reach SSH and RDP targets without custom client code; the release also adds app tokens with customized time-to-live and scope, and virtual-machine auto-discovery across multiple AWS accounts from a single plugin configuration.
Discovery, Containment and Evaluation in Watsonx Orchestrate
IBM’s watsonx Orchestrate announcement introduces an AI Gateway that acts as a single enforcement layer for discovering third-party agents, models and MCP servers across platforms such as Amazon Bedrock, Microsoft and Google, with customers able to interact with those agents through watsonx Orchestrate chat and channels. The discovery capability, in tech preview, connects to platforms such as Amazon Bedrock, Microsoft Foundry and Google Gemini to find agents built in third-party environments, and it extends to models and MCP servers.
The Orchestrate catalog is evolving into a governed catalog aligned to OWASP, CoSAI and the IBM AI Risk Atlas. For select agents including Ziemacs and Cognos Partners, it surfaces performance, reliability and latency metrics plus EU AI Act compliance information; for select MCP servers including Box, Visier and New Relic, it shows protocol conformance, tool schema integrity and default credential rejection.
A containment capability, also in tech preview, runs agents in isolated sandboxes and gives teams a kill switch to shut down any agent, while a Premium Runtime provides hardware-virtualized container isolation, zero lateral movement and hardware-bound resource containment. The evaluation tooling is generally available: teams can test the quality, accuracy and compliance of agents, models and MCP servers before deployment and monitor them in production, with built-in cost tracking of model and token use. New tools include Custom LLM-as-a-Judge evaluation, user simulation with deterministic evaluation, Trace Inspector and an AgentOps Agent that investigates failures and generates test cases. Orchestrate can also connect directly with Microsoft Entra and IBM Verify as identity providers for human and non-human agent identities.
NVIDIA Integration, Availability and Conference Program
IBM said Agent Identity and HashiCorp Vault integrate with NVIDIA OpenShell secure runtime software, the foundation of the NVIDIA OpenShell Architecture, pairing a protected runtime environment with verified identity and short-lived credentials for each agent. John Fanelli, NVIDIA’s vice president of enterprise software, said the work combines OpenShell’s policy-governed runtime with Agent Identity and Vault to support secure execution and tightly scoped access to business systems.
On availability, HashiCorp Vault 2.2, Agent Identity, the watsonx Orchestrate evaluation capabilities, IBM Concert and Terraform policy are generally available; Secure Hub, Terraform Developer Portal, Terraform remote MCP server and IBM Z Atlas are in public preview; and IBM Integration Intelligence Hub and the Orchestrate discover and contain capabilities are in tech preview.
Client speakers at the conference include athenahealth on automating certificate management with Vault’s PKI engine; Albert Einstein College of Medicine on applying IBM Verify and Vault to agent identity, just-in-time access, dynamic secrets and auditability; Optum on Vault Radar and Boundary; Seven-Eleven Japan on Vault Enterprise and Vault Radar; and Yum! Brands on building an identity security platform with IBM Verify. Shailesh M. Shenoy, Assistant Dean for Information Technology at Albert Einstein College of Medicine, said technologies such as IBM Verify and HashiCorp Vault can help organizations establish the identity, access and security controls needed to innovate with confidence.
IBM said this year’s TechXchange, which incorporates HashiConf, brings together nearly 6,500 attendees from 85 countries, with more than 1,000 sessions, 180 hands-on labs, 260 client-led sessions and more than 50 certification exams.
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.