IBM, SailPoint, RSA Race to Control AI-Agent Identities in Enterprise IAM

IBM Agent Identity Integrates with Existing IdPs

IBM released Agent Identity, a system that registers AI agents, issues short-lived credentials, and enforces privilege ceilings on agent actions. The product integrates with IBM Verify, Microsoft Entra ID, Okta, Ping Identity, and HashiCorp Vault Enterprise, allowing enterprises to authenticate agents through existing identity providers rather than building a parallel stack.

Agent Identity associates each AI agent with the human operator behind it and revokes credentials when activity deviates from expected behavior. HashiCorp Vault Enterprise 2.2 added on-premises application-startup authentication using trusted platform modules, reducing the exposure window for static credentials.

The integration approach reduces rip-and-replace risk, but buyers should validate agent-volume licensing, credential-revocation latency, and audit retention before treating this as an add-on. Agent identity is emerging as a separate budget line within IAM and AI-governance programs, not a minor extension of workforce identity budgets.

SailPoint Updates On-Premises Platform and Agentic Controls

SailPoint announced IdentityIQ 9.0 for hybrid and on-premises deployments, alongside expanded controls in its Agentic Fabric for non-human identities and Human Fabric for workforce identities. The release gives regulated organizations an on-premises option while SailPoint competes with IBM, Microsoft, Okta, CyberArk, and Delinea in agent governance.

Existing IdentityIQ customers may face lower migration costs than organizations evaluating a new platform, but procurement teams should separate the value of the 9.0 upgrade from broader agentic-identity claims. Specific questions include supported agent protocols, policy-evaluation performance under load, migration effort, and whether agent identities are priced per identity, per workload, per transaction, or per connector.

RSA Sets November 16 Launch for Agent ID Discover and Secure

RSA confirmed general availability of Agent ID Discover and Secure on November 16, 2026, with Agent ID Govern planned for the first half of 2027. The platform focuses on regulated industries where proving the human authority behind a consequential agent action is a compliance requirement.

The concrete launch date gives enterprises a near-term evaluation milestone, but buyers should avoid purchasing on the basis of the future Govern module until its availability, controls, integrations, and pricing are specified. Near-term evaluations should focus on agent discovery coverage, identity binding to human operators, privileged-action approval workflows, and evidence suitable for regulatory audits.

Commvault Adds Cross-Provider Identity Recovery

Commvault announced identity-resilience capabilities covering Active Directory, Microsoft Entra ID, and Okta. The product detects identity, permission, and configuration changes across providers; identifies privileged Tier 0 assets; and provides AI-guided remediation, rollback, and recovery of trusted identity configurations.

This extends Commvault beyond data backup into identity resilience, competing with Semperis, Tenable, Netwrix, Quest, Rubrik, Microsoft, and CyberArk. The key purchasing question is whether identity recovery is included in an existing Commvault contract or requires a separate module and subscription.

Enterprises with mixed AD–Entra–Okta estates should assess whether cross-provider visibility reduces separate tooling, but should demand evidence on recovery time objectives, rollback granularity, immutable backup protection, and restoration testing. Backup alone does not demonstrate that a compromised identity plane can be safely restored under attack conditions.

Ping Adds NFC Verification in Early Access

Ping Identity's October updates include NFC verification for PingOne Verify, currently in early access. The feature allows a mobile device to read the secure NFC chip in a government-issued identity document or passport, competing with identity-proofing providers such as Entrust, Jumio, Socure, Veriff, and LexisNexis Risk Solutions.

Ping also added Identity Profile Certification in PingOne Identity Governance, allowing reviewers to certify identity records.

NFC verification may improve resistance to forged or altered documents, but early-access status makes production readiness, supported documents, geographic coverage, mobile-platform support, and per-verification pricing critical diligence items. Identity Profile Certification could reduce manual governance work, but buyers should measure reviewer-hours saved and determine whether it satisfies their audit evidence requirements.

What to Watch

Agent identity is no longer experimental. IBM, SailPoint, and RSA are shipping products with concrete release dates and existing IdP integrations. Enterprises should expect separate budget lines for agent identities, non-human credential management, and runtime authorization within IAM and AI-governance programs.

Buyers evaluating these platforms should demand measurable details on agent-volume limits, credential-revocation latency, policy-evaluation performance, migration effort, and pricing models. Abstract claims about agentic security should be replaced with specific answers: supported agent protocols, recovery time objectives, rollback granularity, and evidence suitable for regulatory audits. The category is forming now, and purchasing decisions made in the next six months will determine enterprise agent-identity architecture for years.