BNP Paribas gave every AI agent its own identity and access scope

Each agent gets an identity and only the access its task needs. That is the most consequential sentence BNP Paribas published this week.

BNP Paribas and Google Cloud announced a five-year partnership on September 24, 2026. The dateline ran from Paris and Sunnyvale.

The bank gains expanded access to Google Cloud infrastructure, Gemini models, and Gemini Enterprise. Deployment starts in Corporate and Institutional Banking.

The first named workflow is corporate credit memos. Agents prepare them to assist the teams that own the decision.

Further applications are planned across sales, trading, research, and structuring. Those are the revenue-generating desks, not the back office.

Gemini models also go into LLM@CIB. That is the division's internal assistant, available to more than 65,000 employees.

Now the line that matters most. Each agent is authenticated and granted access only to the resources its assigned task requires.

Agent connections to the group's systems are monitored and controlled. So are the interactions between agents.

That is least-privilege access applied to software that makes judgments. Call it Know Your Agent, pointed inward.

Group CIO Marc Camus framed the deal as multi-cloud and multi-model. The bank picks the model and the level of control case by case.

Google Cloud CEO Thomas Kurian called agentic AI a critical shift in how banks assess risk and serve clients. That is the vendor framing.

The bank's framing is narrower and more useful. Agents assist teams on targeted workflows.

The five-year term is the tell. Nobody signs five years for a solved problem.

Two things here are real and one is not yet.

LLM@CIB is real at scale. More than 65,000 employees already use it.

That is an assistant, not an agent. It answers, and it does not execute.

The agentic deployments are described as planned. Contracted, scoped, and not yet running.

Gemini Enterprise for Financial Services was in preview as of August 25. Preview means design partners, not general availability.

Compare that to the working benchmark. DBS scaled credit agents to about 1,500 bankers on August 19, after a 150-person pilot.

BNP has the larger contract and the smaller deployment. Announcement size and production size are different measurements.

Nobody has published an error rate. Not DBS, not BNP, not Google.

The credit decision does not move. A named officer and a committee still own the loan.

The word in the release is assist. That is a legal position as much as a technical one.

The permission model is human too. Somebody decides what scope each agent gets.

Somebody reviews the monitoring output. Least privilege only works if a person maintains the privilege list.

And the multi-model choice is human. Camus described selecting the right model for each case, which is a judgment nobody has automated.

Start with the obvious role. The CIB analyst who builds the credit memo.

That job was already in play. DBS put a number on it, saying memo work absorbs up to 40% of a relationship manager's time.

Now the less obvious one. Identity and access management inside the bank.

That function existed for employees and vendors. It now has to cover software that acts on its own.

Every agent needs a scope, a review cycle, and a revocation path. That is a permanent operating cost, not a project.

Then the vendor layer. Google gains a five-year annuity inside a systemically important European bank.

IBM already holds a ten-year cloud deal with BNP signed in April 2025. Two long contracts with two providers is not indecision.

Credit memo agents in production at BNP: twelve to eighteen months. DBS went from pilot to 1,500 users in months, and the path is now well worn.

Sales and research agents: two to three years. Those outputs reach clients, which changes the liability picture.

Trading and structuring agents: much longer. Market risk plus European rules is the slowest combination in the business.

Here is the part that explains the multi-model language. The EBA published new third-party risk guidelines on September 18.

They demand substitutability for any provider supporting a critical function. A bank that can only run on one model has no exit plan.

So multi-cloud and multi-model is compliance architecture. It reads like procurement strategy and it functions as a regulatory answer.

Watch the Sibos programme this week for the same theme. Agentic identity, control and compliance is a named session track.

Watch for a published scope framework too. The first bank to disclose how it grants and revokes agent permissions sets the template.

Territory: +machines on the workflow, +incumbents on the permission.

Credit memo and research preparation move to agents, while the bank keeps the authority to decide what each agent may touch.