Goldman was right to pull back. Now comes the harder part.
NOV. 4, 2026
3 Min Read
Restricting AI coding agents stops the risk. Knowing how well your teams use them is what lets you scale.
In July, Goldman Sachs was celebrating traders and bankers who built their own tools with AI. By October, the bank had limited Claude Code and other third-party coding agents to its engineers.
That reversal will get read as a story about AI going wrong. I read it differently. It's a story about engineering discipline, and what happens when a powerful tool skips it.
The tool isn't the risk. Ungoverned use is.
A coding agent does what it's asked, with the access of the person asking. In an engineer's hands, that output goes through code review, automated testing and deployment controls before it touches anything real. Those gates exist because experienced engineers know how software fails.
A trader who builds a script to model positions or monitor client flows usually doesn't go through any of that. The script works on Tuesday, gets shared on Wednesday and is part of someone's daily workflow by Friday. Nobody reviewed it. Nobody tested the edge cases. Nobody knows what it does when the market does something unusual.
In financial services, that gap is expensive. Three risks stand out:
- Access without accountability. The agent inherits the user's permissions. If that user can see production data, so can every tool they build.
- Controls that never apply. Information barriers, audit trails and change management live in the platform. Tools built outside it don't inherit them.
- Code no one understands. When the person running the code can't explain how it handles an edge case, you don't have a tool. You have an exposure.
None of these are new risks. Agents just make them faster and more common.
Restriction is a stopgap, not a strategy
Pulling access back was sensible. But it leaves the bigger question open. The business demand that drove traders to build their own tools hasn't gone away, and most firms can't answer a basic question about the teams who still have access: How well are your people using agents?
Not how many seats you bought. Not how many tokens you spent. How well. Are they reviewing what the agent writes? Are they testing it? Are they using it on the right problems? Is the code they ship better or just faster?
If you can't answer that, you're flying blind, and you're carrying risk you can't see.
What controlled adoption looks like
The firms that get this right won't be the ones that ban agents or the ones that hand them to everyone. They'll be the ones that treat agentic development like any other production capability.
In practice that means four things:
- Know who is deploying what. Keep an inventory of agent-built tools, who owns each one and what data it touches.
- Hold agent code to the same bar. Review, testing and release controls apply whether a person or an agent wrote the code. No exceptions for "just a script."
- Measure quality, not volume. Score how teams use agents against a best-practice rubric, then coach to close the gaps.
- Put experienced engineers on production. Business users can prototype and describe what they need. Specialist engineers own what goes live.
How we work
At Lumenalta®, our more than 500 specialists use agents every day. They do it inside the same review and release discipline we apply to any production code. The agent speeds up the work. The engineer stays accountable for it.
We also measure it. Atlus Insights scores how our teams use agentic tools against a best-practice rubric, and we use those results to reinforce and coach. It's how we know our speed isn't coming at the cost of quality.
We're now helping financial services firms do the same for their own teams: get visibility into how agents are being used, set the standard, and put the controls in place. Most can get there in 12 weeks.
Goldman made the right first move. The next one is knowing exactly what your teams are doing with these tools. If that's a question you can't answer yet, I'm happy to compare notes.
Source: The State of AI coverage of Goldman Sachs' coding-agent restrictions, citing Bloomberg reporting.
