The first three chapters kept coming back to one idea: Bob acts through a user profile, so on IBM i an agent is an identity on the box, and you govern it the way you govern any identity. On day two of TechXchange in Atlanta, IBM made that same idea the centerpiece of its agent announcements, for every platform.
IBM's software chief framed the week this way: The winners in enterprise AI are changing how their business runs.
1 The products announced alongside that line say a lot about what IBM thinks running a business with agents requires.
What IBM announcedIdentity first, then everything else.
- Agent Identity, generally available. Working with HashiCorp Vault, it keeps a record of each agent's owner, its lifecycle status and the authority it's been granted. It enforces least-privilege access and can revoke an agent's access in real time if it tries something it isn't authorized to do.1
- Vault 2.2, generally available. Agents get their own secured accounts, with credentials renewed automatically rather than borrowed from a person.1
- Contain and Evaluate in watsonx Orchestrate. Contain, in tech preview, runs agents in isolated sandboxes with a kill switch. Evaluate, generally available, tests agents for quality, accuracy and compliance before deployment, then monitors them in production and tracks cost per agent.1
- Integration Intelligence Hub, tech preview. Helps agents work with existing systems, with approval policies and audit controls built in.1
Read together, the list describes a shape: an agent is a first-class identity with an owner, a scope, a lifecycle and a record, and it can be contained and switched off. That's a sensible model, and it's the direction much of the industry is moving.
The IBM i readTwo vocabularies, one idea.
For most platforms, these are new capabilities. For an IBM i shop, each one has a long-standing counterpart, because a user profile has always carried the same properties. Here's the mapping:
*ALLOBJ, right-sized with authority collectionCHGUSRPRF STATUS(*DISABLED), and its access ends at the next sign-onQAUDJRN, with command auditing per profileNone of this replaces what IBM announced. Agent Identity and Vault manage agents across clouds, models and platforms, which an IBM i profile was never designed to do. The point is narrower and more useful: when your organization adopts an enterprise agent identity model, the IBM i side won't be starting from zero. It will be the part that already works this way.
Every agent has an owner, a scope and an off switch. On IBM i, so does every profile.
Where Bob fitsAlready inside the model.
Bob reaches IBM i through the user profile of its Code for IBM i connection.2 So on the box, Bob already lands inside this identity model. The profile is its identity: owned, scoped, auditable and revocable with commands your team has run for years.
This week's announcement doesn't describe a connection between Bob and Agent Identity, and it would be getting ahead of IBM to assume one. It's a good question to ask while everyone is in Atlanta: how will Bob sessions show up in an enterprise identity model, and how will that meet the profile Bob already uses on IBM i? Whatever the answer, a shop that has set up Bob the way Chapter 03 describes will find it easy to plug in.
What to do MondayThree moves that pay off either way.
Inventory every identity an agent uses.
Bob profiles, service profiles that automation runs under, anything an agent signs on as. Put a named owner beside each one.
Rehearse the off switch.
Pick one Bob profile and disable it in a test window. Time how long it takes and confirm the next session can't start. An off switch you've never used isn't one yet.
Give agents an expiration date.
Set an expiration on Bob profiles so access lapses unless someone renews it. That's lifecycle management in one parameter.
See how your platform already scores on identity, reversibility and audit.
Take the IBM i readiness read