What IBM announced
At TechXchange on October 27, IBM says Agent Identity, HashiCorp Vault 2.2, and watsonx Orchestrate evaluation capabilities are generally available. The bundle brings together agent identity, credential controls, and management across platforms. Its availability list also contains previews, so check the particular capability rather than treating the whole announcement as one finished release. [1]
The linked Agent Identity announcement is dated October 26. That product’s general availability therefore predates the October 27 bundle. We verified the dates shown on the pages, but did not establish an exact posting hour. [1][2]
Identity, access, and evaluation have different jobs
IBM describes Agent Identity as a central record of an agent’s owner, lifecycle, and delegated authority. Its announcement describes task-scoped tokens and audit trails connecting people, agents, credentials, and actions. Vault can supply short-lived credentials for systems that cannot consume delegated tokens directly. These are IBM’s descriptions of its controls, rather than results from a Tinker & Tokens security test. [2]
Orchestrate’s evaluation features include business-defined judging criteria, simulated user journeys, checks on tool calls and parameters, and inspection of execution traces. Those tools can help teams examine behavior; an evaluation score still needs to be interpreted against the actual job and its failure cases. [3]
Keep the preview labels visible
Orchestrate Discover and Contain are in tech preview. IBM describes discovery across outside agent platforms, models, and MCP servers, with containment offering isolation and a kill switch. Secure Hub, which provides visibility across Vault environments, is in public preview. Those stages differ from the generally available evaluation and identity capabilities. [1]
The three announcements do not establish the edition, regional availability, account configuration, or price needed for a particular deployment. We did not install the products, verify customer access, or test whether the advertised controls prevent an unauthorized action. [1][2][3]
Our take
For experienced technicians, start with an accountable owner and one bounded job. Record which data and tools the agent needs, which actions it may take, when its credentials expire, how access can be revoked, and what evidence each action leaves. Give consequential changes a clear human review point.
A reviewed pilot should examine permitted work and denied actions, using fictional or approved data. Check the logs and revocation behavior as well as the answer. Identity, limited permissions, and result checking each deserve evidence before an agent takes on a broader business workflow.