'/%3E%3C/svg%3E){kind=small}
The first AI agent is up and running. It retrieves data, generates a report, and delivers the results. It works. So the second one is added. And the third. And suddenly, the team asks itself: Who actually has the big picture?
IBM answers precisely this question with new features in watsonx Orchestrate.
Why is a single AI agent no longer enough for finance operations?
Many finance teams start with one agent. One for forecasting. One for reporting. One for data reconciliation. The more AI agents are in use, the more important the issue of control becomes.
Without orchestration, the following happens: Agents access systems without anyone having a complete overview. Access rights are scattered. Errors made by an agent go undetected until the result is incorrect.
IBM addresses this with a structured approach: First, identify all agents. Then, control them. Then, evaluate them.
What’s behind Discover, Contain, and Evaluate?
IBM has introduced three functional layers in watsonx Orchestrate:
What does Agent Identity mean for finance?
Agent Identity is a key IBM concept: Every AI agent is assigned its own digital identity. This identity determines which systems it can access and which actions it is permitted to perform.
This has direct implications for controlling teams:
- Access rights can be controlled at a granular level. A reporting agent reads data but does not write anything. A posting agent has precisely defined write access.
- Every action can be traced back to a specific agent. This creates a complete audit trail, which is essential for audits and compliance requirements.
- Compromised agents can be selectively blocked without interrupting other processes.
IBM Vault, which IBM continues to develop in parallel, securely manages credentials and access data for agents in a centralized location. No agent stores access data locally.
Multiple AI agents, but no overview?
We’ll show you what Agent Identity, access rights, and audit trails can look like in your finance environment.
How relevant is this for Planning Analytics and TM1 environments?
IBM Planning Analytics and TM1 are systems that contain sensitive financial data: plan data, forecasts, and budgets. Anyone integrating AI agents into these environments must answer two questions.
Which agent is allowed to access which cube? How is the agent’s activity documented?
This is exactly where Agent Identity and the orchestration features come into play. A forecasting agent that reads TM1 cubes is assigned a defined identity with read access. Write access requires explicit authorization. Every action is logged in the audit log.
These principles apply to any planning environment where AI agents are deployed. IBM has formalized them in watsonx Orchestrate.
What exactly should your team check now?
Five questions to get started with secure agent orchestration:
- Which AI agents are already active? Create a list, including unofficial or pilot agents.
- Which systems do these agents access? An access matrix can help with this.
- Who is responsible for each agent on the business side? Ownership must be clear.
- Is there a governance framework for AI decisions? If not, that’s the next step.
- What compliance requirements apply to automated postings or planning entries?
Anyone who can answer these five questions has a solid foundation for using watsonx Orchestrate or a comparable orchestration tool.
Facts & sources
Glossary
FAQ
Which version of Planning Analytics do I need for watsonx Orchestrate?
watsonx Orchestrate is a standalone platform that connects to Planning Analytics via APIs. A specific PA version is not required. The integration depends on the API interface available in your environment.
Are Discover, Contain, and Evaluate already ready for production use?
As of the publication of this article, these features are available as a Tech Preview. This means they can be tested in defined environments but have not yet been released for full production use.
How much does watsonx Orchestrate cost?
IBM offers watsonx Orchestrate on a usage-based model, depending on the number of agents and the computing power utilized. Specific pricing is available through direct consultation with IBM or an IBM Business Partner such as BI2run.
How does watsonx Orchestrate differ from other agent platforms?
watsonx Orchestrate is tightly integrated with IBM’s infrastructure and security architecture. For teams already using IBM Planning Analytics or other IBM products, integration is more seamless than with third-party providers. We’ll show you how to develop your own AI agents with IBM watsonx in a separate post. For teams without an IBM environment, there are comparable platforms available on the market.
Who is responsible for Agent Identity?
In most companies, this falls within the intersection of IT security and the respective business unit. IT defines the technical access rights. The controller specifies which data an agent is allowed to process and which it is not.
