IBM Agent Identity
Gives an AI agent its own registered identity, a named owner and short-lived access tokens, so a shop can see which agent asked for data instead of finding a borrowed human login in the audit trail. IBM made it generally available on October 26, 2026 at IBM TechXchange 2026, and it runs with IBM watsonx Orchestrate, IBM Verify or Microsoft Entra, and HashiCorp Vault.
What IBM Agent Identity does
Most AI agents log in as a person. The agent borrows a user name and password, so the audit trail says a human did the work. Picture a temp worker who shows up and borrows a full-time employee's badge. Every door the temp opens gets stamped with the employee's name. IBM Agent Identity hands the temp a badge of their own. The badge has an owner, a short list of doors it opens, and an expiration.
- Registers each agent in a central inventory with its owner, its metadata and a risk class.
- Keeps the on-behalf-of link, meaning the record of which person the agent is acting for, even as the request moves between identity providers and token exchanges.
- Hands out OAuth-based tokens that are short-lived and scoped to one task, not full user rights.
- Lets HashiCorp Vault pass the real credential at the moment it is needed instead of leaving it in a file.
- Writes an audit trail that ties the human identity, the agent identity, the credential, the policy decision and the action together.
Why not just let the agent use a user profile?
Because then you cannot tell the two apart. If an agent signs on as QPGMR, every row it reads and every command it runs looks like QPGMR. You cannot shut off the agent without shutting off the person, and you cannot answer the question an auditor will ask, which is who did this.
A borrowed login next to an agent identity
| Question | Agent borrows a person's login | Agent has its own identity |
|---|---|---|
| Who does the audit trail name? | The person whose profile was used | The person, the agent, and the token that was issued |
| How much can it reach? | Everything that profile can reach | Only what the task-scoped token allows |
| How long does access last? | Until someone changes the password | Until the short-lived token expires |
| How do you stop a bad agent? | Disable the profile and break the person too | Use the kill switch, which undeploys the agent and ends its sessions |
The kill switch and the agent audit logs are new in the same IBM watsonx Orchestrate release. Before shutting an agent down, the kill switch shows which collaborator agents might be affected.
How does a request reach Db2 for i?
Four hops from a person's question to a row on IBM i
- Register the agentThe agent gets an entry with an owner, metadata and a risk class. That entry lives in your identity provider, which IBM documents as IBM Verify or Microsoft Entra.
- A person asks the agent for somethingIBM watsonx Orchestrate keeps the on-behalf-of link between that person and the agent, even when the request crosses identity providers and token exchanges.
- Issue a short-lived tokenThe agent receives an OAuth-based token that is scoped to the one task and expires on its own. HashiCorp Vault can hand over the real credential just in time.
- The tool call lands on IBM iIBM's IBM i MCP Server reaches Db2 for i through Mapepire on port 8076, using the values in DB2i_HOST, DB2i_USER, DB2i_PASS and DB2i_PORT. IBM i then checks object authority against that user profile.
Model Context Protocol, or MCP, is how an AI reaches a tool such as a Db2 for i query. Step four is the hop Agent Identity does not reach: IBM's quick start for the IBM i MCP Server puts one shared IBM i user profile and password in an .env file.
Can an IBM i shop use it today?
Yes, for the part above IBM i. If your agents already run in IBM watsonx Orchestrate and reach your system through an MCP server, Agent Identity gives each of those agents its own identity, its own short-lived access and its own audit trail. What it does not do is create IBM i user profiles or change IBM i object authority. On the box, authority is still decided by the user profile the connection signs in with. So the two jobs stay separate: name and limit the agent on the agent side, and keep the IBM i profile behind your MCP server narrow on the IBM i side.
IBM's October 27, 2026 press release says that by 2028 the average Fortune 500 enterprise will use over 150,000 AI agents, and that only 13 percent of organizations believe they have the right AI agent governance in place. Those figures are IBM's own. IBM's Agent Identity pages also mention neither IBM i nor Model Context Protocol by name, so treat the IBM i side of any design as your own work until IBM documents it.
What else IBM shipped the same day
- Generally available: Agent Identity, HashiCorp Vault 2.2, IBM watsonx Orchestrate evaluate capabilities, IBM Concert, and HashiCorp Terraform policy.
- Public preview: Secure Hub, plus the Terraform Developer Portal and the Terraform remote MCP server.
- Technology preview: IBM Integration Intelligence Hub, watsonx Orchestrate discover and contain, and IBM Z Atlas.
Related Terms
watsonx Orchestrate
IBM's AI agent and automation platform for orchestrating multi-step business workflows across enterprise applications. Since August 2026 it can launch IBM Bob from its Create an agent dialog through a Build with Bob preview, but it still ships no IBM i or Db2 for i connector.
watsonx Orchestrate Agent Builder
watsonx Orchestrate Agent Builder is where an AI agent is actually defined: its name, its written instructions, the large language model that reasons for it, and the list of tools it is allowed to call. For an IBM i shop the tool list is the whole story, because it accepts a Model Context Protocol (MCP) toolkit, and that is the practical way to point an Orchestrate agent at Db2 for i data when IBM ships no IBM i connector.
IBM watsonx.governance
IBM watsonx.governance is the part of the watsonx platform that watches AI models after they are switched on, checking them for bias and drift and keeping a record an auditor can read. For an IBM i shop it is an oversight layer, not a tool that runs on the box: IBM publishes no IBM i feature for it, and the only documented link is the Db2 for i data connection it shares with watsonx.ai.
Model Context Protocol
An open standard, released by Anthropic on November 25, 2024, that defines a client-server architecture for connecting AI applications to external data sources, tools, and prompts over JSON-RPC 2.0. IBM's IBM i MCP Server is an implementation of it for Db2 for i and other IBM i resources.
IBM i MCP Server
An open-source, IBM-published server implementing the Model Context Protocol (MCP), letting AI agents and LLMs query Db2 for i data and take defined actions on IBM i using natural language. In beta since October 2025.
Agent2Agent Protocol
An open protocol that lets one AI agent hand work to another agent it did not build, so an IBM i shop can keep its Db2 for i tools behind its own agent and still let an outside agent ask that agent for an answer. Google published it in April 2025 and gave it to the Linux Foundation on June 23, 2025; IBM's watsonx Orchestrate connects external A2A agents, and IBM's ContextForge MCP Gateway federates A2A servers beside Model Context Protocol servers.
ContextForge MCP Gateway
IBM's open source gateway that puts one governed endpoint in front of every Model Context Protocol server, so an IBM i shop can register its Db2 for i tools once and let any AI client reach them with shared login checks, rate limits and logging. IBM's own IBM i MCP Server project ships a container stack that runs the gateway on port 4444 beside an IBM i SQL tools server on port 3010.
Mapepire
An open-source database access layer for Db2 for i, created by IBM and introduced in an August 2024 IBM blog post as a lighter, cloud-friendly alternative to ODBC and JDBC. A server daemon runs on IBM i and Node.js, Python, Java, and .NET Core clients connect to it over Secure WebSockets.
Db2 for i
The relational database management system built into every IBM i operating system, tightly integrated with IBM i rather than a separately installed database product.
IBM i
IBM's operating system for Power servers running traditional AS/400-lineage business applications, with Db2 for i built directly into the OS.