Agent identity

IBM Verify treats every AI agent as a distinct, accountable identity in your environment. Rather than borrowing credentials from a user or application, each agent is issued its own persistent identity record at onboarding. That record becomes the single anchor point for authentication, access control, delegation, and audit — across the entire agent lifecycle.

The agent identity model is built around three responsibilities:

• Establish who the agent is — A unique, durable Agent ID is assigned at registration. It persists across credential rotations, redeployments, and model updates, so every action can always be traced back to a known, governed identity.
• Control what the agent can do — Access is granted through scoped, short-lived tokens rather than standing permissions. The token type issued — identity, delegated, or privileged — is determined by the operation the agent needs to perform and the policy governing that operation.
• Record what the agent did — Because each agent holds its own identity, its activity is attributable at the agent level, not just at the application or user level. This makes compliance reporting, anomaly detection, and revocation precise and auditable.

How it fits together

An agent moves through a defined sequence before it can operate in your environment. It must be registered and approved before any credentials are issued. Once active, it authenticates using OAuth 2.0 grant flows and receives tokens scoped to its permitted actions. When it needs to act on behalf of a user or perform an elevated operation, it exchanges tokens rather than requesting broader standing access. At every stage, IBM Verify enforces policy and maintains an audit record tied to the agent's identity.