Governing coding agents in a bank: a 12-point checklist

Summary of a playbook on muthub.org

Read the full playbook on muthub.org →

Reviewed by Muthu · Playbook · Last verified Oct 18, 2026 · Drafted Oct 17, 2026 by seed-import/1.0 · Re-check by Apr 17, 2027 · 1 source

Show in graph · Markdown

Overview

The controls a regulated enterprise needs before coding agents write production code at scale. One page, kept current, meant to be copied into your own standards.¹

Points

1. Write down what each agent may do
2. Give every agent its own identity
3. Send every model call through one gateway
4. Govern the tools as well as the models
5. Curate the context agents read
6. Put policy in the pipeline
7. Keep maker and checker separate
8. Record provenance for every change
9. Scan everything agents add
10. Use specs for high-risk changes
11. Measure outcomes, not usage
12. Plan for the bad day

Sources

1. Governing coding agents in a bank: a 12-point checklist · published Oct 11, 2026

Footnotes

1. Governing coding agents in a bank: a 12-point checklist, muthub.org, reviewed 2026-10-11. ↩