A regulated bank limits agent risk with walls, not trust in the model

A bank that lets AI agents write code does not have to trust the AI to behave. It can build walls around the agent instead. Two Monzo engineers, Felipe Felisola Caso and Francesco Galletta, laid out this approach on the AI Engineer show. They described how the bank runs its in-house coding agent.

What was said

According to the show notes, Monzo's agent writes more than a tenth of the merged pull requests across its tech teams. The notes add that it handles upwards of 1,800 tasks each day. The guests described three layers of control.

First, a gateway sits in front of internal tools and knowledge. The team picks what to expose to agents, and the gateway handles sign-in and permissions for each agent. Second, remote agents run in a sandbox, an isolated space kept apart from production systems. An agent image defines the exact tools each agent gets. Third, a proxy handles traffic going out. Monzo decides which outside connections the agent may use, such as the link to its code repositories.

A speaker on the show gave the reason: "Again, we are a bank. We live in a regulated environment." The aim was to control the agent's unpredictable behavior, while still letting it run freely inside its space. In the speaker's words, "So that box inside the box inside the box is where the non-determinism happens". Non-determinism means the same request can produce different results.

Why it matters

Our reading: this design sets, in advance, how far an agent's mistake can reach. What the gateway exposes and what the proxy lets out mark the limit. That is a limit on reach, not a promise that failures stay small.

If an agent misuses access it was legitimately given, or the gateway exposes sensitive data, the cost could still fall on whoever's data or accounts were within reach. For anyone building or buying agent software, this suggests three questions. What can the agent reach? What can it send out? Who decides? Each can be asked before anything goes wrong.

The other side

The excerpts do not show how Monzo catches a failure inside the box. They also do not cover what happens if an agent misuses access it was legitimately given. The speakers described the gateway as a way to open data to the agent safely, but that is their own claim, and the excerpts offer no incident record.

The guests also credited what Monzo already had. A speaker played on the letters LLM to say that earlier platform pieces each gave the team a small boost. The excerpts do not say how a firm without that platform could copy the design.