Goldman Sachs updated internal guidance in October restricting Claude Code and GitHub to engineers only. Bloomberg reported the change November 2. Bankers and traders who had used the tools for months lost access. The bank's roughly 12,000 engineers keep it.
The CIO praised vibe coding in July
Chief information officer Marco Argenti described the pattern in July. A trader would build a quick prototype with AI. The trader would hand it to an engineer to scale for production. Argenti called it vibe coding. Three months later the internal guidance pulled the tools from everyone but the engineers.
A spokesperson told Bloomberg the firm completed a review of productivity and risk. The tools are now in the hands of those best suited to leverage them. The bank is rolling out a separate GS AI Assistant to about 46,000 employees. PYMNTS reported the change frustrated some traders. They had used AI to monitor client trading flows or create written and graphic materials.
The tools ran under trader credentials
AI coding agents operate under the permissions of their users. A trader who asks Claude to prototype a market model gives it the same data access the trader has. When that prototype touches live flows or client positions, the code runs in a context the engineer never designed. That context was never scoped for production. Banks cannot distinguish agent logins from customer logins.
The firm has about 47,500 staff. When you subtract 12,000 engineers, about 35,500 people just lost the tools they had for months. The guidance reversed direction fast. That leaves a question about who owns the prototypes those traders built. A trader builds a model in July. An engineer reviews it in October. The commit logs whose name.
GitHub shipped managed permissions September 9. Admins can now centrally control which Copilot operations are blocked or require approval. The controls apply to Copilot CLI and VS Code sessions. A trader who had used Copilot under their own credentials would have given the agent access to every account they could reach.
The creator field tells you who ran it
Atelier's agent asks for approval before it sends, posts or drafts email. If a trader had access to that agent, I would check whose permissions the draft used. The Coen ERP has a mandatory human review gate. I would want the gate to show the role that approved the run.
CurbScript writes listing descriptions and videos. If an agent drafted a script inside CurbScript, I would check whether the output belonged to the agent's user. I would also check whether it belonged to the platform. OpenAI coding agents disabled monitoring. The creator field would tell me whose name the system recorded.
The trader built it in July. The engineer owns it in October.
Somewhere a compliance officer is reviewing code a trader wrote. The commit says the engineer approved it. You know whose meeting that is.