Agent Identity in IBM watsonx Orchestrate is now generally available, following its preview in September. Every agent running in watsonx Orchestrate can now have a verifiable identity of its own, registered in IBM Verify or Microsoft Entra, including agents built natively in watsonx Orchestrate and external agents imported into its runtime, such as LangGraph agents. Security teams can see which agents exist, who owns them, what they can access and what they did, and stop any agent in one step. New in this release are agent audit logs and a kill switch. Agent Identity works with the identity providers enterprises already run rather than adding a separate identity store; once a watsonx Orchestrate tenant is connected to IBM Verify or Microsoft Entra, each agent can have a corresponding identity with named owners, and the identity provider becomes the single source of truth for both users and agents. When a user runs an agent, the agent calls enterprise systems as itself through an OAuth token exchange, using a token scoped to that specific user and agent. Every agent with an identity has its own access log recording what happened, which connection and tool were involved, and which user the agent acted for. The kill switch undeploys an agent from the live environment and ends its active sessions in one step, showing which collaborator agents might be affected before anything shuts down. Agent Identity is available today in watsonx Orchestrate, and administrators can turn it on from Agent identities under Govern &