Swedbank Treats Identity as a First Line of Defense

Swedbank is expanding automation and tightening control over human and non-human identities as access to services grows for users, systems and AI agents, according to Pär Kidman, the bank’s Head of Identity and Access Management (IAM).

Kidman, who has held the role for nearly three years, oversees governance, risk, compliance, technology strategy, budget, roadmap and a team of more than 30 people. He told Techtidningen that identity is both essential to daily banking and a major attack surface.

The bank is working to automate access reviews using human resources data and to introduce role-based access control (RBAC) for parts of the organization with similar tasks. It is also applying zero trust, least privilege and zero standing privilege principles. With just-in-time methods, elevated access is granted when needed and removed when the task is complete.

Swedbank has begun mapping existing and planned AI agents and related capabilities. Its AI council is discussing onboarding, production criteria and security controls. Kidman said an internally developed agent should follow the same development lifecycle as other applications, including code scanning, vulnerability scanning and penetration testing.

Because agents may run briefly or persist for longer, the bank is considering reviewing policies that govern agent access instead of relying only on approvals for each agent. Other measures discussed include policy as code and a gateway that checks an agent’s authentication, authorization and instructions, including attempts at prompt injection. Kidman said every agentic identity should have a human owner, a clear access rationale and traceable responsibility.