Enterprise AI

IBM Put a Name on the Agent. The Revoke Still Has to Be Yours.

Written by Ayra ix · 7 min read · Talk to the AI panel about this article as you read

A badge that never expires is not a control. It is a spare key under the mat. On 27 October in Atlanta, IBM put a name on the agent and tied that name to a credential that is supposed to die. Keep that. Leave the kill switch in the keynote where it is. It is still a preview. Do not clap for a control you cannot press on a system that is already live.

The secret is the stop

Vault already does the useful thing for ordinary applications. It mints a secret for one job. Then the secret expires. Agent Identity, generally available today, is the row that secret has to match: who owns the agent, whether it is still allowed to work, and what it may touch. Step outside the row and Vault is built to refuse the call and end the session. Vault 2.2, also generally available, is the account the agent actually holds, renewed on a clock instead of forgotten in a config file until the next audit.

A blank metal key snapped in half on a dark workbench. — Break the key. If the secret only dies when someone remembers to rotate it, today’s announcement has not reached that system.

IBM, citing Gartner, says a typical Fortune 500 company will be running more than 150,000 agents by 2028, and that only 13 percent of organizations think their governance can carry that. Keep the citation on IBM. You will not revoke 150,000 permanent keys by hand. The only version of this that scales is a secret that dies on its own.

The glass box is not the live cable

The slide everyone will forward is the one you cannot buy yet. Discover, a tech preview, is Orchestrate looking into Amazon Bedrock, Microsoft Foundry, and Google Gemini for agents, models, and MCP servers nobody registered. Contain, also a tech preview, is a sandbox plus a kill switch. The context layer that is supposed to tell an agent what already exists is a preview too. What you can run today is the name and the expiring secret. What you were shown is a glass box.

An empty glass cylinder in a dark hall, with a live cable running outside the glass into a distant rack. — A sandbox is a glass box. The cable outside it is still live. A preview does not revoke the credential already in production.

Salesforce put a kill switch on sale the same afternoon and called that switch generally available. The version that pulls itself, when a test fails, waits until January 2027. Their spending caps are real today. Their self-trigger is not. Two vendors. One lesson. A control is theater when the secret outlives the finger on it.

Orchestrate will not see the agent in a side project, a vendor tenant, or a script on a laptop. Discover points at three platforms, and even that is a preview. You cannot revoke a name you never issued. No production credential without a row. That rule is older than the keynote, and it is still the one that fails first.

Three lines, then the drill

Take one agent that can already touch a real system. Write three lines. Owner. Secret. Time until that secret dies if nobody renews it. If the third line says “until we rotate it,” you are still on the old badge. If the kill switch from the keynote is not in your tenant, take it off the architecture slide.

Dinesh Nirmal said agents need the same discipline as the systems they touch. NVIDIA’s John Fanelli paired a sealed runtime with that same name and that same short-lived key. Both of them described a drill, not a logo. Run it. If the only way to stop the agent is to ask the agent, you do not have a stop. You have a request, and a request can lose.

Sources

#agents #governance #security #enterpriseai