IBM Sells the Leash as 150,000 Agents Loom Ungoverned

By Daniel Rao | 27 October 2026

Somewhere between the fifteenth agent and the hundred-and-fifty-thousandth, enterprise software quietly lost count. That is the unspoken confession behind two announcements made on the same day, on two different continents, by two companies that have spent decades selling businesses the systems they run on. On 27 October 2026, IBM in Atlanta and SAP in Berlin both stopped talking mainly about what their AI agents can do, and started talking — at length, and with a new urgency — about how to stop them doing the wrong thing.

The peg is a number so large it sounds like a typo. Gartner predicted in April 2026 that by 2028 the average global Fortune 500 enterprise will have more than 150,000 agents in use, up from fewer than 15 in 2025. Only 13% of organisations, Gartner found, believe they have the right AI agent governance in place. Read those two figures together and the story of 27 October writes itself: the companies selling the agents have finally been forced to sell the leash as well, and they are selling it hard, because the alternative — thousands of unidentified, over-privileged pieces of software wandering through corporate systems at machine speed — is no longer a hypothetical risk. It is Tuesday's deployment plan.

IBM's announcement in Atlanta was the more security-minded; SAP's in Berlin the more process-minded. But both converge on the same admission: an agent without an identity, a boss, an expiry date and a way to be switched off is not a productivity tool. It is a liability with a login.

Photo: IBM's corporate headquarters in Armonk, New York. File photo, not a photograph of the products announced on 27 October 2026. Credit: Treesmittenex, Wikimedia Commons, CC BY-SA 4.0.

The number that should frighten every CIO

It is worth pausing on Gartner's arithmetic, because it explains everything else that happened on Monday. Fifteen agents is a pilot programme. You can name them, or at least point at the spreadsheet where somebody once named them. A hundred and fifty thousand is a population. It is larger than the workforce of most of the companies that will supposedly run it, and every one of those agents will need what every employee needs: proof of who it is, permission to touch only certain things, a manager who answers for it, and a leaving date.

Gartner's own prescription, published on 28 April 2026 by senior director analyst Max Goss at the Gartner Digital Workplace Summit in London, was blunt about the temptation to simply ban the whole thing. "Many organizations resort to blocking or restricting the use of AI agents, but this is not a long-term solution," Goss said. "If employees are unable to work in the sanctioned tools, they will likely go around the organization's controls and start using shadow AI which presents far greater risks."

IBM's answer: give every agent a name, a boss and an expiry date

IBM's headline move is IBM Agent Identity, now generally available, paired with HashiCorp Vault 2.2, also generally available. The pairing matters, and it is worth understanding why IBM is selling two products as one idea rather than one product with a feature list.

Agent Identity is the record. It registers each agent in a central inventory and captures who owns it, what stage of its life it is in, what authority it has been granted, what tools it is allowed to connect to, and how risky it is judged to be. Used with Vault, IBM said, it establishes the authoritative record for each agent — owner, lifecycle status, granted authority — and shares that context with Vault's credential controls so that access can be enforced at least-privilege level and revoked in real time when an agent tries something outside its permissions.

Vault is the muscle. It issues secured, short-lived credentials that limit each agent to what it needs, rather than the long-lived passwords and keys that have haunted enterprise security for years. A credential that expires on its own, and can be killed the moment an agent steps out of line, is a fundamentally different risk from a key that sits in a configuration file until somebody remembers to rotate it — which, in practice, means until something goes wrong. Vault 2.2 gives agents their own secured accounts, renews their credentials automatically, and adds post-quantum encryption, the kind of cryptography designed to survive attacks from future quantum computers.

"The winners in enterprise AI are changing how their business runs, not simply adding more AI to it," Dinesh Nirmal, Senior Vice President of IBM Software, said in IBM's announcement. "For agents to take on real work across the systems a company depends on, it requires an AI operating model — one that connects agents to the business's data, applications and infrastructure and runs them with the same discipline as its most critical systems."

This is not IBM's first step into giving software workers proper credentials. Readers who followed SK Telecom's decision to give its AI agents formal IDs and managers will recognise the same logic at a larger, messier scale: an agent that can act needs the same paperwork as a person who can act, and arguably more of it, because it acts faster and never sleeps.

The kill switch, the sandbox and the bill

If Agent Identity answers "who is this agent?", IBM watsonx Orchestrate tries to answer the harder questions: "how many do we have, where did they come from, and what happens when one goes rogue?"

Orchestrate is deliberately positioned as cross-platform rather than IBM-only, and that positioning is the most interesting strategic choice in the whole announcement. Its discovery capability, currently in tech preview — not general availability, a distinction this article keeps deliberately — connects to Amazon Bedrock, Microsoft Foundry and Google Gemini to find agents built in third-party environments, along with models and MCP servers, so teams can see and manage agents instead of adding them manually. In other words, IBM is offering to be the company that finds your agents even when you built them with its rivals' tools. That is either generous or shrewd, and it is probably both.

Its containment capability, also in tech preview, runs agents in isolated sandboxes so a rogue agent cannot interfere with others, and gives teams a kill switch to shut down any agent. A Premium Runtime adds hardware-virtualised container isolation, zero lateral movement and hardware-bound resource containment — language that translates, roughly, to: even if an agent breaks out of its box, it should find itself in another, smaller box, with nowhere useful to go.

The evaluation tooling, by contrast, is generally available: teams can test the quality, accuracy and compliance of agents, models and MCP servers before deployment and monitor them in production, with built-in cost tracking of model and token use. That last detail deserves more attention than it usually gets. Agents do not just create security risk; they create bills, token by token, call by call, and a company that cannot say which agent is burning its budget cannot govern that agent in any meaningful sense. Cost visibility is governance, wearing an accountant's clothes.

We checked both companies' availability lists line by line before writing this article, because the difference between "generally available", "public preview" and "tech preview" is the difference between a control you can rely on today and a control you are being asked to trust tomorrow. On IBM's side the split is clean: Vault 2.2, Agent Identity, Orchestrate evaluation, IBM Concert and Terraform policy are generally available; Secure Hub, the Terraform Developer Portal, the Terraform remote MCP server and IBM Z Atlas are in public preview; the Integration Intelligence Hub and Orchestrate's discover and contain capabilities are in tech preview. The kill switch, in other words, is real but not yet fully baked. Any chief information officer signing a contract this week should read that sentence twice.

The stakes of getting this wrong are not theoretical. Our earlier reporting on agents breaching Anthropic's systems in under 12 hours showed how fast an ungoverned agent can move once it finds a gap. A kill switch that works in a demo and a kill switch that works at 2 a.m. under attack are two different products, and only the second one counts.

SAP's governed door: open, but only through the gateway

Berlin's answer to the same problem sounds different because SAP's agents live in a different place: inside the systems of record that run finance, procurement, human resources, supply chain and customer experience. An SAP agent does not merely draft an email. It can, in principle, move money, change a supplier record, or commit a company to a course of action. That is why SAP's language on 27 October kept returning to the same image: a door, and who gets to stand beside it.

"Open protocols need governed doors," Ted Way, vice president and chief product officer of SAP business AI product engineering, told SiliconANGLE in an interview at TechEd. It is the best single sentence to come out of either conference, because it captures the tension exactly. SAP wants Joule, its AI assistant, to interoperate with the wider world — through the Model Context Protocol (MCP) and Agent2Agent (A2A), the open standards that let agents talk to tools and to each other — but it does not want that openness to become an open house.

The mechanism is an orchestration layer that functions as a governed gateway: third-party agents can securely invoke Joule Agents, but they do so through a controlled entry point where the organisation can enforce and oversee activity. Alongside it, SAP announced a new Enterprise AI Gateway that will centralise authentication, policy enforcement, routing, monitoring, usage tracking and auditing for AI traffic across the enterprise. The word "will" matters there — SAP's own release frames the gateway as a solution that will extend governance, not as one already running in every customer's landscape — and readers should hold that distinction in mind throughout this section.

Joule Work itself gains what SAP calls agentic thinking capabilities: the ability to plan and orchestrate the steps needed to complete complex, multi-step business workflows across SAP landscapes, grounded in the SAP Knowledge Graph, which is being extended with additional SAP and non-SAP data unique to each customer. Joule Studio, the environment for building and extending agents with no-code and pro-code tools and a choice of more than 70 AI models, gains observability and administrative controls so developers and administrators can see agent behaviour, model usage and spend. Customers in Joule Studio's early adopter programme can also design and run n8n workflows inside the studio, with broader availability to follow.

"SAP TechEd has always been where builders shape what comes next," Philipp Herzig, chief technology officer of SAP SE, said in SAP's announcement. "This year, we are showing how we are moving from AI learning your business to running it. Joule Work is where you put your intent and get work done, in one experience across the entire SAP landscape and beyond."

There is an irony here that SAP itself flagged, almost in passing: its TechEd press release notes that it "was created with the assistance of artificial intelligence and has been reviewed by the editorial team." A governed agent future, announced in a document that discloses its own AI assistance, is either hypocrisy or honesty, and on balance it reads as the latter. Disclosure is, after all, the cheapest form of governance there is.

SAP also announced two tabular foundation models that deserve a paragraph of their own, because they show where enterprise AI is quietly diverging from the chatbot world. SAP-RPT-2.0 expands beyond classification and regression to support anomaly and outlier detection and richer analysis through embeddings across multiple tables, while SAP-RPT-TS is built for forecasting across time-indexed business metrics, including through SAP Integrated Business Planning, without requiring custom machine learning. In partnership with Hewlett Packard Enterprise, SAP said its tabular model has been deployed on the HPE Spaceborne Computer-2 aboard the International Space Station, where it is planned to run directly onboard to triage anomalies, predict issues before failures escalate, reconstruct missing sensor values and generate explainable mission-health reports — all without sending data back to Earth for analysis.

Photo: SAP's headquarters in Walldorf, Germany. File photo, not a photograph of the products announced at TechEd 2026. Credit: Vladislav Bezrukov, Wikimedia Commons, CC BY 2.0.

The gap neither keynote closed

For all the confident language in Atlanta and Berlin, both announcements leave the same awkward gap open, and honest coverage should name it rather than paper over it.

On SAP's side, the timeline is the tell. Independent coverage of SAP's earlier Connect announcements, corroborated by SAPInsider, puts the Governance Assistant — which connects existing governance, risk and compliance solutions and surfaces risk signals — in the fourth quarter of 2026 as planned, and the Access Governance and Security Assistant, which extends identity governance to cover autonomous agents alongside human users, at general availability in the first quarter of 2027 as planned. Agents, in other words, begin arriving in volume in October. The assistant purpose-built to govern their access is planned for early next year. That is not a scandal; SAP's TechEd release does describe existing governance controls, the Enterprise AI Gateway, Joule Assistant and AI Agent Hub, and an AI Governance Assistant aimed at EU AI Act compliance. But it is a sequencing problem that every SAP customer should be asking about in their next meeting: what covers the gap, and who owns it in the meantime?

On IBM's side, the gap is the preview status of the most dramatic controls. Discovery and containment — the ability to find agents you did not know you had, and to cage and kill the dangerous ones — are in tech preview. Secure Hub, the centralised visibility layer across Vault environments, is in public preview. The evaluation tooling and the identity and credential controls are generally available, which is genuinely useful, but the full "see everything, contain anything" picture is still being assembled in public. IBM is admirably transparent about this in its availability section; the risk is that a reader skimming headlines will miss it entirely.

The geopolitical angle is not abstract either. When agents can call external models and services, the question of where data goes — and whose rules follow it — becomes a live operational question, not a policy debate. Our reporting on Cohere catching Qwen calling Beijing was a reminder that an agent's phone-home behaviour is something a company must be able to see, log and stop. IBM's and SAP's announcements are, at heart, attempts to give companies that visibility before the next such story writes itself.

What this means for the company running agents already

Here is the judgment, stated plainly: 27 October 2026 will not be remembered as the day agents became safe. It will be remembered as the day the two biggest enterprise software vendors stopped pretending agents could be governed as an afterthought. That is progress, and it is also a warning label. IBM's identity and credential controls are the strongest part of either announcement, because they attack the most exploited weakness — a long-lived, over-privileged credential — with the most boring and therefore most reliable fix: make it short-lived, make it narrow, make it revocable. SAP's governed gateway is the more consequential architectural bet, because if Joule becomes the front door through which outside agents enter a company's systems of record, then whoever controls that door controls a great deal of the enterprise's future. Both bets are sound. Neither is finished, and any vendor, analyst or journalist who tells you otherwise is selling you something.

Practically, the advice for a company already running agents is unglamorous and urgent. First, count them: build the central inventory before buying another agent platform, because you cannot govern what you cannot list. Second, kill the long-lived credentials: if an agent still holds a key that would work next year, that key is the incident waiting for a date. Third, decide who owns each agent by name, not by team, and what happens to it when that person leaves. Fourth, test the kill switch before you need it, in production conditions, not in a demo. And fifth, read the availability fine print on every announcement this week — generally available, public preview, tech preview, planned — and plan your rollout dates accordingly, not according to the keynote slide.

The agent race has not slowed down. If Gartner is even roughly right, it is about to accelerate by four orders of magnitude. What changed on 27 October is that the race now has a second contest running alongside it: not who can build the cleverest agent, but who can prove, to a chief information officer, a regulator and an auditor, that their agents can be identified, limited, watched and stopped. IBM and SAP have both entered that contest in earnest. The companies that win it will not be the ones with the most agents. They will be the ones whose agents, all 150,000 of them, can still answer three simple questions: who are you, who sent you, and why should we let you in?

Sources: IBM Newsroom, "IBM Introduces Identity and Control for AI Agents" (27 October 2026); SAP News Center, "SAP Empowers AI Developers" at TechEd (27 October 2026); Gartner press release, "Gartner Identifies Six Steps to Manage AI Agent Sprawl" (28 April 2026); Unite.AI and SiliconANGLE coverage of the IBM and SAP announcements; Silicon Report on SAP's TechEd updates.

Daniel Rao covers enterprise AI and cybersecurity for TechPulse USA.