Enterprises are deploying AI agents faster than they can verify them. IBM's announcement at TechXchange 2026 names it precisely. By 2028, according to Gartner, the average Fortune 500 will run more than 150,000 AI agents. Only 13% of organizations believe they have the right AI agent governance in place. IBM's answer is built into HashiCorp Vault: each agent gets a verified identity, short-lived credentials scoped to what it needs, and real-time revocation when it attempts an unauthorized action.
The mechanism is specific. An agent doesn't authenticate once and roam freely. Agent Identity holds the record of who owns it and what authority it has been granted, and short-lived credentials limit what it can touch and for how long. Attempt something outside those permissions and access can be denied and the session revoked in real time.
The same check, already running
Factua runs a customer acquisition platform called FactuaOS across a portfolio of businesses. A compliance agent called Stickler sits at the point where any agent's work would reach a customer. It checks what it needs to know: is consent on file for this record in the Factua customer data platform, is the contact on a suppression or do-not-call list, does this asset carry what the vertical requires. The send either ships or it holds.
Nexus7Media, Factua's legal and compliance-heavy lead generation business, writes its consent records to the Factua customer data platform and reads suppression lists back from it. A lead can still carry a consent gap or a DNC match. Stickler checks for it before the outreach leaves.
Why the mechanism travels
IBM's point is that every agent needs a verified identity and only the access it needs. The credential expires. If the agent attempts an action outside its approved permissions, access can be denied and the session revoked in real time.
Stickler checks every send, and the agent that built the outreach never decides whether it goes.
