AI coding agents for 30,000+ engineers, inside a regulated bank
Challenge
Engineers wanted the latest AI coding agents; Risk and Cyber needed proof that source code and sensitive data would stay protected, that usage was auditable, and that costs wouldn't run away.
Approach
- Routed every tool through an enterprise gateway on AWS Bedrock with OAuth, RBAC and per-user, per-minute token limits.
- Shipped centrally managed settings, project memory standards, hooks and MCP configuration so guardrails travelled with the tool.
- Instrumented usage with OpenTelemetry for cyber logging and developer-productivity metrics.
- Built a fast, tested release cadence so new models reached engineers in days, not quarters.
Outcome
- 30,000+ users across Claude Code and Cowork, with Codex and Windsurf alongside
- Cost held down with prompt caching, model routing and effort-level tuning
- A pattern Risk, Cyber and the Model Risk Office could approve and reuse