--- title: Introducing Agent Identity in IBM watsonx Orchestrate description: IBM Agent Identity is now generally available, giving AI agents in watsonx Orchestrate an assigned agent identity instead of impersonating user credentials.... canonical: https://daily.dev/posts/introducing-agent-identity-in-ibm-watsonx-orchestrate-0vdr1teax twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Introducing Agent Identity in IBM watsonx Orchestrate | daily.dev og:description: IBM Agent Identity is now generally available, giving AI agents in watsonx Orchestrate an assigned agent identity instead of impersonating user credentials.... og:url: https://daily.dev/posts/introducing-agent-identity-in-ibm-watsonx-orchestrate-0vdr1teax og:image: https://api.daily.dev/og/posts/0vdr1TEax.png og:image:alt: Introducing Agent Identity in IBM watsonx Orchestrate og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Introducing Agent Identity in IBM watsonx Orchestrate **[Niklas Heidloff](https://daily.dev/sources/heidloff)** · 3 min read · 1 upvotes · 0 comments ## Summary IBM Agent Identity is now generally available, giving AI agents in watsonx Orchestrate an assigned agent identity instead of impersonating user credentials. Agents get delegated, minimum-required privileges instead of full user rights, and access can expire automatically using tools like HashiCorp Vault. A walkthrough shows agents running on behalf of users via OAuth Token Exchange, with IBM Verify as the Identity Provider, and tracked with an Identity ID and an Agent UUID. Execution traces capture both the User ID and Agent ID, and a 'Kill agent' button immediately disables an agent if security issues arise. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does IBM Agent Identity in watsonx Orchestrate differ from agents impersonating user credentials? Instead of agents running with the exact same rights as a human user via impersonation, IBM Agent Identity grants agents only the minimum required privileges through delegation. For example, an agent might be allowed to cancel a hotel reservation but not authorize an upgrade. Access rights can also be configured to expire automatically using tools like HashiCorp Vault. _Teams securing autonomous agents can follow identity and delegation models like this one on daily.dev._ ### What identifiers does watsonx Orchestrate use to track AI agents with Agent Identity enabled? Agents use two distinct identifiers: an Identity ID, which also appears in the IBM Verify interface, and an Agent UUID, the unique Orchestrate agent ID used when invoking specific agents, shown in Verify as External IDs. Execution traces capture both this Agent ID and the User ID of the person on whose behalf the agent acted. _Developers tracing agent actions back to specific identities can find setups like this on daily.dev._ ### How can I immediately disable a compromised AI agent in IBM watsonx Orchestrate? watsonx Orchestrate provides a 'Kill agent' button, shown prominently in the upper right corner of the agent interface, which immediately disables the agent if security issues arise. This works alongside Agent Identity's delegated, minimum-privilege access model rather than full user impersonation. _Engineers planning incident response for autonomous agents can track safeguards like this on daily.dev._ ## Similar posts on daily.dev - [Passing User Identity safely across Agents and Enterprise Systems](https://daily.dev/posts/passing-user-identity-safely-across-agents-and-enterprise-systems-olnhxffga) · Niklas Heidloff · 1 upvotes · 0 comments - [AI Agent Identity: How to Authenticate and Govern AI Agents](https://daily.dev/posts/ai-agent-identity-how-to-authenticate-and-govern-ai-agents-pii52p4wl) · Security Boulevard · 0 upvotes · 0 comments - [User Accountability in agentic watsonx Orchestrate Apps](https://daily.dev/posts/user-accountability-in-agentic-watsonx-orchestrate-apps-4zayijrqr) · Niklas Heidloff · 0 upvotes · 0 comments - [Agent as Principal: A Purpose-Built Identity for Agents](https://daily.dev/posts/agent-as-principal-a-purpose-built-identity-for-agents-uuqpfnuoq) · Auth0 · 0 upvotes · 0 comments - [Every AI Agent Is an Identity. Most Organizations Don't Treat Them That Way](https://daily.dev/posts/every-ai-agent-is-an-identity-most-organizations-don-t-treat-them-that-way-lfuwbbpbz) · BleepingComputer · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication), [#agentic-ai](https://daily.dev/tags/agentic-ai), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/introducing-agent-identity-in-ibm-watsonx-orchestrate-0vdr1teax) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Introducing Agent Identity in IBM watsonx Orchestrate","url":"https://daily.dev/posts/introducing-agent-identity-in-ibm-watsonx-orchestrate-0vdr1teax","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/introducing-agent-identity-in-ibm-watsonx-orchestrate-0vdr1teax"},"datePublished":"2026-10-29T16:18:14.114Z","dateModified":"2026-10-29T16:20:14.911Z","description":"IBM Agent Identity is now generally available, giving AI agents in watsonx Orchestrate an assigned agent identity instead of impersonating user credentials....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/709174e193e234db8411deebe015e771?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/709174e193e234db8411deebe015e771?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Niklas Heidloff","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Niklas Heidloff","logo":"https://media.daily.dev/image/upload/s--1T53PJFj--/f_auto/v1743317445/logos/heidloff","url":"https://daily.dev/sources/heidloff"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/introducing-agent-identity-in-ibm-watsonx-orchestrate-0vdr1teax","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,authentication,agentic-ai,oauth","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Niklas Heidloff","item":"https://daily.dev/sources/heidloff"},{"@type":"ListItem","position":3,"name":"Introducing Agent Identity in IBM watsonx Orchestrate"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/introducing-agent-identity-in-ibm-watsonx-orchestrate-0vdr1teax#faq","mainEntity":[{"@type":"Question","name":"How does IBM Agent Identity in watsonx Orchestrate differ from agents impersonating user credentials?","acceptedAnswer":{"@type":"Answer","text":"Instead of agents running with the exact same rights as a human user via impersonation, IBM Agent Identity grants agents only the minimum required privileges through delegation. For example, an agent might be allowed to cancel a hotel reservation but not authorize an upgrade. Access rights can also be configured to expire automatically using tools like HashiCorp Vault. Teams securing autonomous agents can follow identity and delegation models like this one on daily.dev."}},{"@type":"Question","name":"What identifiers does watsonx Orchestrate use to track AI agents with Agent Identity enabled?","acceptedAnswer":{"@type":"Answer","text":"Agents use two distinct identifiers: an Identity ID, which also appears in the IBM Verify interface, and an Agent UUID, the unique Orchestrate agent ID used when invoking specific agents, shown in Verify as External IDs. Execution traces capture both this Agent ID and the User ID of the person on whose behalf the agent acted. Developers tracing agent actions back to specific identities can find setups like this on daily.dev."}},{"@type":"Question","name":"How can I immediately disable a compromised AI agent in IBM watsonx Orchestrate?","acceptedAnswer":{"@type":"Answer","text":"watsonx Orchestrate provides a 'Kill agent' button, shown prominently in the upper right corner of the agent interface, which immediately disables the agent if security issues arise. This works alongside Agent Identity's delegated, minimum-privilege access model rather than full user impersonation. Engineers planning incident response for autonomous agents can track safeguards like this on daily.dev."}}]} ```