Goldman Sachs now limits Claude Code and GitHub's AI coding tools to its engineers, under guidance it updated in October. Traders and bankers had used them for months. In July the bank's chief information officer was praising the way a trader would build a prototype with AI and hand it to an engineer to finish. The bank's only explanation is that it reviewed productivity and risk management.
Banks kept the spreadsheet and added rules
Nobody took Excel away from bankers after the London Whale losses, because it was too useful. The banks and their regulators wrote the same short set of rules instead. Keep a list of the spreadsheets that matter, limit who can change their inputs, make the person who built a calculation different from the person who checks it, and compare its numbers with the official records. The tool stayed in everyone's hands, and the control moved to the point where other people started relying on what it produced.
An AI-built tool is harder to check than a spreadsheet
A spreadsheet shows its working. Anyone can click a cell and see the formula. A program written by an AI assistant is hundreds of lines in a language most traders do not read, so the person who built it usually cannot check it either. It can also be connected to live data and able to act, not only calculate. Spreadsheets spread through banks over decades, and this reached the trading floor in months. Tools that employees build for themselves are already a growing share of costly data breaches, so the worry is not only Goldman's.
The line belongs at who depends on the tool
Goldman drew its line by job. Engineers keep the tools, and so do the hybrid staff it calls strats, who combine engineering, research and trading. But a person's job title says little about whether a tool is dangerous.
Take a finance manager at a regional distributor who builds a small tool that matches supplier invoices to purchase orders. While it is only hers, a mistake costs her an afternoon, because she sees the output and knows the work. Then three colleagues start using it to approve payments. If it saves each of the four of them three hours a week, that is about six working days a month for the team. Then she goes on leave, a supplier sends a credit note in a new layout, and the tool treats it as an invoice. Nothing about her job changed. What changed is that other people's money now depended on something only she had read.
That is the line a company can actually enforce: tools used only by their author, on the author's own work, and tools that other people or other people's money rely on. The second kind gets registered and read by someone else before it is trusted.
Goldman's July workflow already had that shape, since the engineer who finishes the trader's prototype is the second reader. The part that cannot grow is the engineer's time. When AI makes building cheap, people become the bottleneck at the checking step, and a bank with thousands of would-be builders and a limited number of reviewers will feel it quickly. I expect banks to settle, within a couple of years, on the spreadsheet answer: anyone may build, and a tool others depend on is listed and reviewed before it runs on real money, with AI doing some of the first review.
The question for any company is which tools other people now depend on, and who besides the builder has read them.