When a chatbot produces a wrong sentence, the damage may be limited to a bad answer. When an AI agent can call company tools, inspect files, trigger workflows and use credentials, the question becomes more serious: who authorised the action, what could the agent access, and can anyone reconstruct what happened?
That is the problem IBM says its latest watsonx Orchestrate capabilities aim to address. At TechXchange 2026, IBM announced additions spanning a cross-platform AI gateway, an approved-agent catalog, evaluation tools, execution tracing and stronger identity controls. The announcement was published on 27 October 2026.
These are IBM’s product announcements and descriptions. Independent performance or security outcomes have not been established by the announcement alone.
In this article
The main additions at a glance
| Announced capability | Intended function | The practical question to ask |
|---|---|---|
| AI Gateway | Discover and govern connected agents, models and MCP servers across platforms | Which third-party systems are actually supported in my environment? |
| Governed catalog | Help teams find approved reusable agents with evaluation and risk information | Who approves entries and how often are assessments refreshed? |
| Custom evaluation and user simulation | Test scenarios, task success and tool-call behaviour | Do tests match real customer and operational failures? |
| Trace Inspector / AgentOps Agent | Inspect agent execution, diagnose and optimise failures | Can we retain useful traces without exposing sensitive data? |
| Agent identity and access controls | Connect agent authorisation with enterprise identity and credentials | Can an agent access only the data and actions it genuinely needs? |
Why this matters beyond IBM users
Many organisations now build AI-assisted processes in more than one environment. A customer-service team may use one provider, developers another, and internal workflow tools a third. That creates a governance gap: individual teams may know what they deployed while central security teams do not have a complete inventory.
IBM says its AI Gateway will work with connected assets across ecosystems including Amazon Bedrock, Microsoft, Google and custom solutions. The broader goal is to oversee agents without rebuilding each one on an IBM-only stack. This should be viewed as a product capability claim, not proof that every agent built on every framework is supported today.
What is an MCP server, and why check it?
The Model Context Protocol (MCP) is used by AI systems to connect with tools and external data. A server might offer a file search, ticket action or database operation. That convenience introduces risk if a tool description is misleading, input validation is weak or a service is given excessive credentials.
IBM says its governed catalog surfaces checks for select MCP servers, including protocol conformance, tool-schema integrity, description safety, input validation and default credential rejection. Notably, the announcement refers to select agents and servers for several of these signals; readers should not infer complete coverage of every integration.
From a demonstration to production: testing the agent
Traditional software testing usually asks whether known inputs produce expected outputs. Agents can choose different actions and tools during a task, so a simple “the answer looked good” test is insufficient.
IBM describes four related tools:
- Custom LLM-as-a-Judge evaluation lets organisations specify task-specific criteria in natural language.
- User simulation and deterministic evaluation test journeys against expected calls and parameters.
- Trace Inspector helps show what steps and tool interactions occurred.
- AgentOps Agent is intended to investigate failures and help generate or improve tests.
There is an important limitation: an AI model evaluating another AI model is not the same as a fully independent audit. For high-impact workflows, teams should combine automated evaluation with human review, access restrictions, known-good test cases and incident procedures.
Security: an AI agent should not become an invisible employee with unlimited access
IBM also pointed to IBM Agent Identity, HashiCorp Vault, and integrations with Microsoft Entra and IBM Verify. The intended approach is to identify agents as entities, define permissions and handle credentials according to least-privilege principles.
For a business, a useful test is concrete: Can a customer-support agent read an order status but not issue a refund above a specified amount without a human approval? Does an agent keep access after its project is retired? If an action goes wrong, can a security team determine the initiating identity, tool and record changed?
An implementation that cannot answer those questions still has a governance gap, regardless of the product label on its dashboard.
What is announced versus what is proven?
IBM’s post describes capabilities and plans to address fragmented inventories, agent risks and quality monitoring. It is a primary product statement, but it does not by itself establish independent benchmarks for detection accuracy, integration completeness, reduction in incidents, pricing or general availability across all packages and regions.
Before adopting such a platform, a technology team should request a supported-integration matrix, release and availability details, data-handling terms, deployment architecture, audit-log retention options and a pilot using its actual workflow failures.
FAQ
Is this a new consumer chatbot? No. The announcement centres on enterprise management, monitoring and security for AI agents.
Does the AI Gateway replace Amazon, Microsoft or Google systems? IBM presents it as a layer for managing connected agents across platforms, not as a mandate to replace them.
What is the biggest security issue with agents? Giving autonomous workflows more tool permissions than they need, without logging and review, can turn an error into a real-world action.
Does IBM guarantee agents will be safe? Its announcement describes intended controls; security still depends on implementation, supported integrations, policies, testing and oversight.
Who should pay attention? Enterprise technology leaders, IT administrators, developers, risk teams and organisations moving agents from pilots into customer or internal workflows.
Bottom line: The interesting development is not that AI agents can do more. It is that major vendors are building controls to identify, test, trace and restrict them. The remaining question is how reliably those controls perform in each real deployment.
Primary source: IBM announcement, 27 October 2026.
Related reading: Google passkeys on a shared computer
Visual credit: NewsThreads247. Conceptual AI-generated illustration; not an IBM product screenshot.