You’re using AI agents in your Planning Analytics environment. But do you know which agent is currently accessing which cubes and acting on behalf of which department? It is precisely this lack of control that makes AI governance the most pressing compliance issue in enterprise controlling.
IBM unveiled Vault 2.2 on October 29, 2026. For the first time, the system assigns digital identities to AI agents. This gives agents their own certificates, access rights, and audit logs. For controllers and IT managers, this means that every action taken by an AI agent can be traced back to a specific identity.
Until now, this wasn’t possible. Agents ran under human service accounts or shared login credentials. This makes audits difficult. External audits, GDPR requests, and internal evidence requirements often failed on the question: Which AI process accessed this data?
Why uncontrolled AI agents are a governance risk
Imagine that ten different agents access your IBM Planning Analytics cubes every day. One reads budget data, another writes back forecast values, and a third generates management reports. Which one last changed the planning assumptions? Without governance: no answer.
This is not a theoretical problem. Gartner estimates that by 2027, more than 50 percent of all companies with more than 1,000 employees will be using AI agents. Most will do so without a formal governance framework.
For finance teams, three risks converge:
- Traceability: Who or what changed which data?
- Compliance: GDPR, SOX, and BAIT require complete audit trails.
- Stability risk: An uncontrolled agent can overwrite planning data.
What IBM Vault 2.2 actually does
IBM Vault 2.2 is not a password manager or a simple secrets vault. It is an identity solution specifically designed for non-human entities: AI agents, robotic processes, and microservices.
Each AI agent is assigned its own digital identity. This identity includes certificates, access rights, and an assigned profile. Vault 2.2 manages the entire lifecycle. When an agent is deactivated, all access rights are automatically revoked.
The audit log records every access event with a timestamp, identity, and action. For compliance teams, this is the key difference: Instead of “an AI accessed the system,” the log will now read “Agent ID_4712 read the cube BudgetPlan_2027 on October 29, 2026, at 2:37 p.m.”
Integration with IBM Security Verify enables RBAC for AI agents. Agents are subject to the same role concepts as human users. A forecasting agent is allowed to read but not write.
How watsonx Orchestrate coordinates AI agents in finance
watsonx Orchestrate is the control layer that coordinates multiple AI agents as a team. IBM developed Vault 2.2 as the governance foundation for this.
For a controlling team, this might look like this: A planning agent reads current actual data from IBM Planning Analytics. An analysis agent checks for variances compared to the previous month. A reporting agent creates a comment for the monthly management report. watsonx Orchestrate coordinates the sequence and ensures that no step begins until the previous one is complete.
Vault 2.2 ensures that each of these agents accesses only the data for which it is authorized. That’s AI governance in practice.
Is your Planning Analytics environment ready for AI agents?
In a short call, we’ll work out together which governance gaps you should close.
What changes specifically for IBM Planning Analytics users
Anyone using IBM Planning Analytics or TM1 benefits from Vault 2.2 on several levels.
Access control at the cube level: TM1 security policies can now be extended to AI agents. A forecasting agent is granted read access to the sales cube but no write access to the staffing plan. This aligns with the principle of least privilege.
Automatic audit trail: Every AI query on a TM1 cube is logged. This is directly relevant for internal audits and external reviews.
Governance for multi-agent workflows: When watsonx Orchestrate deploys multiple agents in a Planning Analytics workflow, Vault 2.2 logs the entire chain. Complete traceability even for complex AI workflows.
How to build AI agent governance in your company
Building an AI governance architecture follows a logical, step-by-step path:
- Inventory: Identify all AI agents running in your environment. Many companies lack a complete overview.
- Assign identities: Give each agent its own identity. IBM Vault 2.2 handles this process.
- Authorization model: Define which agent accesses which systems. Use RBAC concepts from your existing IT governance.
- Set up monitoring: Configure alerts for unusual access patterns. A forecasting agent that suddenly accesses HR data is a warning sign.
- Regular reviews: AI governance is not a one-time project. Agents come and go. Access rights must be reviewed regularly.
How BI2run supports AI agent governance for Planning Analytics
As an IBM partner specializing in Planning Analytics and watsonx, we help controlling teams integrate AI agents into existing TM1 environments. We assess your current TM1 security architecture, identify governance gaps, and develop a permission concept that fits seamlessly into your existing IT governance.
If the check shows that your governance structure doesn’t need any adjustments yet, we’ll tell you so.
AI Governance · Controlling
Is your TM1 environment ready for AI agents?
We can clarify this in a short orientation call. No sales pitch, no standard deck, just an honest assessment of your governance structure.
Request a call →- IBM Vault 2.2 was introduced on October 29, 2026.
- The system assigns digital identities to AI agents with their own lifecycle management.
- watsonx Orchestrate coordinates AI agents as a multi-agent system in an enterprise environment.
- Gartner: By 2027, more than 50% of all companies with more than 1,000 employees will be using AI agents.
- IBM Security Verify enables RBAC for non-human identities (NHI) in IBM environments.
Glossary: AI governance and IBM Vault 2.2
FAQ: AI governance with IBM Vault 2.2
What is the difference between IBM Vault 2.2 and a traditional password manager?
Password managers manage login credentials for human users. IBM Vault 2.2 manages digital identities for AI agents. This includes certificates, access rights, and audit logs. Vault 2.2 manages the entire agent lifecycle: creation, authorization, and automatic deactivation.
How are IBM Vault 2.2 and watsonx Orchestrate related?
watsonx Orchestrate coordinates AI agents as a team. IBM Vault 2.2 ensures that each agent in this team has its own identity and accesses only the data for which it is authorized. The two components complement each other in a comprehensive AI governance architecture.
Do Planning Analytics users need to set up their TM1 environment from scratch?
No. IBM Vault 2.2 integrates into existing IBM environments. The TM1 security architecture remains in place and is extended with a governance layer for AI agents. Existing user concepts remain valid.
Which compliance requirements does AI agent governance cover?
The GDPR requires traceability in data processing. SOX mandates complete audit trails for finance-related processes. BAIT also addresses the use of automated systems. AI governance frameworks such as IBM Vault 2.2 provide the technical foundation for this evidence.
When is the right time to start with AI governance?
As soon as the first AI agent accesses company data. Integrating Vault 2.2 from the start saves you the effort of migration and audits later on. Many teams start without a governance concept and introduce one retroactively. That is significantly more time-consuming.
