So Goldman Sachs has taken the AI coding tools back off its bankers and traders. According to Bloomberg’s report, access to Claude Code and GitHub’s AI tools is now limited mainly to the bank’s roughly 12,000 engineers (quant strategists are exempt), under internal guidance updated in October. The bit that caught my eye: the people losing access had been “vibe coding” prototypes and handing them over to engineers, which, as the coverage points out, the bank’s own CIO had praised publicly back in July. Four months from showcase to “please hand your keys in”. That’s a quicker turnaround than most banks manage on a password reset 🙂

Now, the easy reaction is to call it a backwards move. I don’t think it is, or at least not entirely. I think Goldman ran into a problem I keep seeing with the companies I advise, and solved it with the bluntest tool in the box.

The Problem Isn’t the Tool

Here’s the thing: a prototype built by someone who doesn’t write software for a living is a brilliant spec. It shows exactly what the person wants, in a form nobody can misread. What it isn’t is production code, and the trouble starts the moment it gets treated as such. Somebody has to own it, review it, secure it, test it and keep it alive at 3am when it falls over. If the prototype lands on an engineer’s desk with a “can you just ship this?” note, you haven’t saved any engineering time; you’ve moved it, and probably added some (reverse engineering what an agent produced at a trader’s request isn’t anyone’s idea of fun).

Multiply that by a few thousand enthusiastic non-engineers in a regulated bank and I can quite easily picture the risk committee’s face. As such, I’m not surprised somebody pulled the plug. I just think they pulled the wrong plug.

Gate the Path to Production, Not the Keyboard

When I was a CTO, the rule I cared about was never “who is allowed to write code”. It was “what has to be true before code reaches production”. Those are very different questions, and AI has made the gap between them a lot wider. Anyone can produce code now; that ship has sailed, and a ban on one or two tools won’t bring it back (people will simply find another chat window, which is worse, as you can’t see what they’re doing).

What I’d do instead, on Monday morning:

• Treat non-engineer prototypes as specs, formally. They go into the backlog as requirements, not as pull requests.
• Give people a sandbox where their creations can run (with fake or read-only data) without ever touching production systems.
• Make the route to production the same for everyone, human or agent: review, tests, security checks, an owner’s name on it.
• Measure how many prototypes turn into shipped features. If the answer is “hardly any”, the bottleneck is in engineering intake, not in the bankers.

Goldman, to be fair, seems to be doing some of this: staff outside engineering are being pointed at the bank’s in-house assistant, which is being rolled out to around 46,000 employees. I’ll give them that. But a general purpose assistant isn’t the same thing as letting a trader describe a tool by building a rough version of it.

Where This Is Going

I’d argue the long term direction is the opposite of what Goldman just did. I believe the future of software engineering is “lights out”: people write the specs, and agents write, test and ship the code. In that world, the trader who can describe precisely what they need (and show it working, roughly) becomes more valuable, not less. The engineer’s job moves towards building the factory: the pipelines, the guardrails, the tests and the review gates that let an agent’s output go live safely. Banning the people closest to the problem from expressing it in code feels like cancelling the whiteboard because someone drew a messy diagram on it.

Don’t get me wrong, I understand why a bank with that much regulatory exposure hits the brakes first and asks questions later. Sure, controls matter, but if a committee needs four months to decide that a tool it praised is now a risk, a smaller competitor with a clear path from idea to production will ship the same feature in a fortnight.

Bottom line: the question I’d want engineering leaders to obsess over is “how good is our road from a messy idea to a safe release?”, rather than “who gets the AI tools?”. Fix the road and you can hand out the tools freely. Leave the road broken and no access policy will save you.

I’d be very interested to hear how other CTOs are handling this, so drop me a line.