IBM used its TechXchange 2026 conference to add a new layer to watsonx Orchestrate, its platform for running AI agents inside large companies. The headline piece is the watsonx Orchestrate AI Gateway, which IBM describes as a single enforcement layer for finding and governing agents, models and Model Context Protocol (MCP) servers that were built on other platforms, including Amazon Bedrock, Microsoft and Google.
IBM aims the pitch at a problem it says enterprises face: teams build agents with different tools, frameworks and clouds, and most platforms give visibility and management mainly within their own ecosystems. IBM calls the product category an "agent management platform." The announcement was published on October 27, 2026.
What IBM announced
IBM grouped the new features into three areas: managing agents across platforms, improving agent quality, and security and identity controls.
Cross-platform management
- AI Gateway. Discovers third-party agents, models and MCP servers on platforms such as Amazon Bedrock, Microsoft and Google, and applies the same observability, evaluation and optimization to them. IBM says customers can now talk to those third-party agents directly through watsonx Orchestrate chat and channels.
- Governed catalog. The existing catalog becomes a place to find, share and reuse approved agents and tools instead of building the same thing twice. IBM says it shows evaluation data at the moment you browse, and that it is aligned to OWASP, CoSAI and the IBM AI Risk Atlas. For select agents, builders and admins can see performance, reliability and latency metrics, plus risk signals and compliance information such as the EU AI Act.
- MCP server checks. For select MCP servers, IBM names Box, Visier and New Relic among them, the catalog shows protocol conformance, tool schema integrity, tool description safety, input validation and default credential rejection.
- Premium Runtime. A dedicated hosting, isolation and metering layer for agents that run custom code or call outside MCP servers. IBM says it addresses those risks through hardware-virtualized container isolation, zero lateral movement and hardware-bound resource containment.
Quality and performance
IBM listed four new testing and monitoring tools:
- Custom LLM-as-a-Judge evaluation, where teams write their own grading criteria in plain language instead of relying only on generic quality scores. For background on the method, see our explainer on LLM-as-a-judge in production.
- User simulation and deterministic evaluation, which runs scripted test journeys and checks that the agent called the right tools with the right parameters before it reaches production.
- Trace Inspector, a step-by-step view of what an agent did, which actions it took and which tools it called.
- AgentOps Agent, a conversational assistant that investigates failures, generates test cases and tunes an agent's quality before it is promoted.
IBM frames these as a loop: evaluate, observe, diagnose, optimize and verify.
Security and identity
- Policy controls for agent behavior, including content guardrails and usage restrictions, which the AI Gateway can extend to connected agent environments.
- IBM Agent Identity and HashiCorp Vault, announced at the same event, work alongside watsonx Orchestrate. IBM says Agent Identity supplies identity and authorization context, and Vault supports least-privilege credential access.
- Direct connections to Microsoft Entra and IBM Verify as identity providers, covering both human and non-human (agent) identities.
Why it matters for businesses using AI
IBM's argument is that enterprises run agents built with IBM, Amazon Bedrock, Microsoft, Google and custom frameworks, so they need to manage them in one place without rebuilding them or standardizing on one platform. SAP also announced gateways at its TechEd conference the same day: a governed agent gateway for Joule Agents and an SAP Enterprise AI Gateway (see our SAP Joule Work explainer).
For a business user, the change is less about new agent skills and more about controls: a governed catalog, test journeys before production, and identities and credentials for each agent. IBM says the objective is not to restrict what agents can do, but to build the trust and security foundation they need to take on more responsibility, and to help companies move beyond experimentation.
IBM says that when agents run dynamic tool code and connect to external community MCP servers, shared-kernel infrastructure presents significant enterprise risks. The Premium Runtime targets that on the hosting side, and the catalog checks for tool description safety and default credential rejection target the MCP servers themselves. For how MCP connects agents to tools, see our MCP architecture explainer.
What IBM did not say
The announcement does not list prices, editions or general availability dates for the AI Gateway, the governed catalog or the Premium Runtime. Several features are described as available for "select" agents or MCP servers, and IBM does not give the full list. It also does not publish benchmark results for the new evaluation tools.
What to check before you buy
- Which of your agents it can see. Ask which specific Bedrock, Microsoft and Google agent types the AI Gateway discovers today, and which only through custom setup.
- Coverage of the catalog checks. Confirm whether the MCP servers and agents you use are in the "select" group that gets metrics and conformance checks.
- Identity setup. If you use Microsoft Entra or IBM Verify, ask how agent identities map to your existing access policies.
- Availability and cost. Get dates and pricing in writing, since the announcement gives neither.
