How Monzo Built Agent Chip into a Reusable Banking Platform

Monzo’s team explains the platform, access controls and workflows behind its in-house agent.

FFFelippe Felisola CasoSpeaker · MonzoFGFrancesco GallettaSpeaker · Monzo
Channel
AI Engineer
Published
Oct 20, 2026
Video
15:30
Read
3 min
Slides
6
Original
English
Open on YouTube
Scroll to read and the video shrinks to the bottom-right corner. Captions follow your reading language.
Reading languageAvailable in 2 languages
You're reading the original English.
SUMMARY

In 30 seconds

Felippe Felisola Caso and Francesco Galletta describe Agent Chip, an internal Monzo agent that began in Slack and grew into a platform component. They explain its MCP gateway, sandboxed orchestration, reported adoption and applications in incidents, data quality and business workflows.

  1. 1Reported adoptionAgent Chip authors over 10% of merged tech PRs and runs more than 1,800 tasks a day, the speakers say.
  2. 2The gatewayThe MCP server controls access to internal tools and knowledge.
  3. 3Sandboxed agentsRemote agents run in an isolated namespace with controlled tools and egress.
  4. 4Incident supportThe agent investigates evidence while humans control its involvement.
  5. 5Non-specialist contributionsBusiness users can initiate drafts that engineers review.

Takeaways

  1. Existing platform capabilities made an internal agent easier to build and operate.
  2. An MCP gateway controls access to internal services and knowledge.
  3. Sandboxing and controlled egress isolate agent operations from production infrastructure.
  4. The agent supports incidents, data-quality triage and non-specialist drafts.
  5. Human engineering review remains part of the deployment workflow.
FULL TEXT

Read the edited text by chapter

Transcript only
01

From Slack reaction to agent

The internal tool grows into a widely used teammate.

Felippe Felisola Caso and Francesco Galletta describe how Monzo built an internal agent and turned it into a reusable platform component. The digital bank maintains more than 3,000 backend services, roughly 13,000 data warehouse models and many machine-learning predictors.

Agent Chip began spreading inside the company in January 2026. A person could react to a Slack message with an emoji and turn that message into a prompt. It grew into an always-available teammate that could answer questions, inspect architecture, review code and take Linear tickets.

Agent Chip adoption
SLIDE 1 / 6Agent Chip adoptionThe speakers report merged PR share, daily tasks and business-user adoption.

The speakers report that Agent Chip authors over 10% of merged pull requests across Monzo technology teams and runs more than 1,800 tasks a day. Business users are also beginning to use it for questions, queries and other self-service tasks. These figures describe the team’s reported usage at the time of the talk.

02

Platform multipliers

Existing infrastructure and the MCP gateway provide a foundation.

Their explanation for its adoption is “lots of little multipliers”: existing platform capabilities that made building and operating the agent easier. Monzo already had monitoring, alerts, integrations, staging, queues, deployment and database abstractions.

Before the remote agent existed, the team had invested in local coding-agent support. An MCP gateway gave agents access to selected internal services, tools and knowledge sources, with authentication and authorization managed at the gateway.

Monzo MCP gateway
SLIDE 2 / 6Monzo MCP gatewayThe gateway connects agents to internal services through authorization and deterministic tools.

The MCP server exposes deterministic operations and controls which capabilities are available. The speakers emphasize supplying useful context while respecting access boundaries, especially in a regulated banking environment.

03

Sandboxed orchestration

Monzo describes isolation, permissions and controlled access.

The team then built an orchestration system to run remote agents in sandboxes inside an isolated namespace. The aim is to separate nondeterministic agent behavior from the rest of production infrastructure while still giving agents room to perform useful work.

Agent orchestration and sandbox
SLIDE 3 / 6Agent orchestration and sandboxThe remote agent runs in a sandbox in an isolated namespace.
Agent sandbox internals
SLIDE 4 / 6Agent sandbox internalsThe image and proxy define tools and controlled connections.

Multiple pods can host sandboxes. An agent image defines the environment, command-line tools and permissions, while a proxy controls selected outbound connections, such as access to code repositories. The architecture deliberately grants only the access needed for each task.

With the gateway and orchestration as building blocks, Monzo can connect Slack, GitHub, Linear and internal services. The agent itself becomes another component on which different parts of the bank can build new use cases.

04

Incidents, data and business users

The agent supports operational and non-specialist workflows.

The speakers say engineers can run a wider range and larger volume of tasks because some work can be delegated to remote agents rather than watched continuously. Routine processes can be automated, leaving people more time for ambiguous problems that require judgment.

Incident mode
SLIDE 5 / 6Incident modeThe example lists the agent’s investigation and reporting actions.

In incident mode, Agent Chip joins an incident channel and investigates logs, traces, the affected service and code. It is designed to give humans high-signal findings rather than flood the channel with speculation, while people control how much support it provides.

In internal ask channels, the agent can use knowledge sources to draft answers for a human or sometimes resolve a request itself. If it needs more context, a person can be brought into the conversation.

Data-quality on-call
SLIDE 6 / 6Data-quality on-callAgent Chip investigates alerts and can prepare a draft fix.

Agent Chip On Call investigates data-quality alert failures. A proactive version also examines backend changes for possible downstream data effects before the next batch runs. These are examples of the team’s workflows, not guarantees that all errors will be caught.

A Slack entry point also lowers the barrier for non-specialists. A business user can ask for a draft based on feedback or an idea; the draft can be tested in staging before an engineer reviews and deploys it. The speakers say the engineering review standard remains in place.

05

Why build in-house

A composable platform can evolve with models and use cases.

Why continue building in-house as the market changes? Monzo sees a reusable, composable platform component that is integrated with its own security and backend requirements. The architecture is designed to be provider-agnostic, so the model can be changed to fit a task.

The team also wants agents to cover more of the development lifecycle, from backend and app changes to staging and data tests. They are not claiming they must keep Agent Chip forever; their argument is that the accumulated platform capabilities have value today and make future use cases easier.

More from this channel

5 slides14:09EN
AI Engineer· Oct 28, 2026Taylor Luttrell-Williams on Finding Logic Vulnerabilities with SonarQube Hunter AgentTaylor Luttrell-Williams · SonarSonar’s Taylor Luttrell-Williams explains how a security agent maps a codebase, investigates logic flaws and presents validated findings alongside conventional scans.CybersecurityAI securityCode review & verification+2
5 slides16:29EN
AI Engineer· Oct 28, 2026Chris Vela on Benchmarking vLLM Configurations with Runpod BenchPodChris Vela · RunpodRunpod’s Chris Vela demonstrates a dashboard for comparing LLM serving configurations and choosing performance settings with workload-specific data.InferenceBenchmarksAI cost & performance+2
6 slides18:52EN
AI Engineer· Oct 28, 2026Manish Kapur and Addy Osmani on Verifying AI Software FactoriesManish Kapur, Addy Osmani · SonarSonar’s Manish Kapur and Anthropic’s Addy Osmani discuss code review, evidence and layered checks as coding agents increase the pace of software changes.Software factoriesCode review & verificationCoding agents+2
5 slides18:35EN
AI Engineer· Oct 28, 2026Kamil Potrec on Agent Authentication, Delegation and Gateway ControlsKamil Potrec · KeycardKeycard’s Kamil Potrec explains why agents need distinct identities, scoped credentials and auditable authorization, and where gateways can help.Agent authAI securityCybersecurity+2
7 slides18:56EN
AI Engineer· Oct 27, 2026John Feminella: Five Controls for AI Agents, and the $900 Million Bank ErrorJohn Feminella · Two SigmaA payment mistake shows why good intentions and approval prompts are not enough. Feminella describes practical controls for giving agents useful autonomy.Safety & governanceAgent engineeringAI in finance+2
5 slides18:12EN
AI Engineer· Oct 27, 2026Tim Tyler: An Accountability Framework for AI Agents as a Digital WorkforceTim Tyler · GraviteeThe Gravitee speaker applies identity, sponsorship, authority and oversight to agents, drawing on how organizations manage human work.Safety & governanceAgent engineeringAgent auth+1