How Monzo Built Agent Chip into a Reusable Banking Platform

Monzo’s team explains the platform, access controls and workflows behind its in-house agent.

FFFelippe Felisola Caso登壇者 · MonzoFGFrancesco Galletta登壇者 · Monzo
チャンネル
AI Engineer
公開日
2026年10月20日
動画
15:30
読了時間
3 分
スライド
6
原文
英語
YouTube で開く
スクロールすると動画は右下に小さくなって再生を続けます。字幕は閲覧言語に合わせて切り替わります。
閲覧言語2 言語で読めます
この記事はまだ日本語に翻訳されていないため、英語の原文を表示しています。
要約

30 秒でわかる

Felippe Felisola Caso and Francesco Galletta describe Agent Chip, an internal Monzo agent that began in Slack and grew into a platform component. They explain its MCP gateway, sandboxed orchestration, reported adoption and applications in incidents, data quality and business workflows.

  1. 1Reported adoptionAgent Chip authors over 10% of merged tech PRs and runs more than 1,800 tasks a day, the speakers say.
  2. 2The gatewayThe MCP server controls access to internal tools and knowledge.
  3. 3Sandboxed agentsRemote agents run in an isolated namespace with controlled tools and egress.
  4. 4Incident supportThe agent investigates evidence while humans control its involvement.
  5. 5Non-specialist contributionsBusiness users can initiate drafts that engineers review.

ポイント

  1. Existing platform capabilities made an internal agent easier to build and operate.
  2. An MCP gateway controls access to internal services and knowledge.
  3. Sandboxing and controlled egress isolate agent operations from production infrastructure.
  4. The agent supports incidents, data-quality triage and non-specialist drafts.
  5. Human engineering review remains part of the deployment workflow.
全文

チャプターごとに整えた全文を読む

文字起こしのみ
01

From Slack reaction to agent

The internal tool grows into a widely used teammate.

Felippe Felisola Caso and Francesco Galletta describe how Monzo built an internal agent and turned it into a reusable platform component. The digital bank maintains more than 3,000 backend services, roughly 13,000 data warehouse models and many machine-learning predictors.

Agent Chip began spreading inside the company in January 2026. A person could react to a Slack message with an emoji and turn that message into a prompt. It grew into an always-available teammate that could answer questions, inspect architecture, review code and take Linear tickets.

Agent Chip adoption
スライド 1 / 6Agent Chip adoptionThe speakers report merged PR share, daily tasks and business-user adoption.

The speakers report that Agent Chip authors over 10% of merged pull requests across Monzo technology teams and runs more than 1,800 tasks a day. Business users are also beginning to use it for questions, queries and other self-service tasks. These figures describe the team’s reported usage at the time of the talk.

02

Platform multipliers

Existing infrastructure and the MCP gateway provide a foundation.

Their explanation for its adoption is “lots of little multipliers”: existing platform capabilities that made building and operating the agent easier. Monzo already had monitoring, alerts, integrations, staging, queues, deployment and database abstractions.

Before the remote agent existed, the team had invested in local coding-agent support. An MCP gateway gave agents access to selected internal services, tools and knowledge sources, with authentication and authorization managed at the gateway.

Monzo MCP gateway
スライド 2 / 6Monzo MCP gatewayThe gateway connects agents to internal services through authorization and deterministic tools.

The MCP server exposes deterministic operations and controls which capabilities are available. The speakers emphasize supplying useful context while respecting access boundaries, especially in a regulated banking environment.

03

Sandboxed orchestration

Monzo describes isolation, permissions and controlled access.

The team then built an orchestration system to run remote agents in sandboxes inside an isolated namespace. The aim is to separate nondeterministic agent behavior from the rest of production infrastructure while still giving agents room to perform useful work.

Agent orchestration and sandbox
スライド 3 / 6Agent orchestration and sandboxThe remote agent runs in a sandbox in an isolated namespace.
Agent sandbox internals
スライド 4 / 6Agent sandbox internalsThe image and proxy define tools and controlled connections.

Multiple pods can host sandboxes. An agent image defines the environment, command-line tools and permissions, while a proxy controls selected outbound connections, such as access to code repositories. The architecture deliberately grants only the access needed for each task.

With the gateway and orchestration as building blocks, Monzo can connect Slack, GitHub, Linear and internal services. The agent itself becomes another component on which different parts of the bank can build new use cases.

04

Incidents, data and business users

The agent supports operational and non-specialist workflows.

The speakers say engineers can run a wider range and larger volume of tasks because some work can be delegated to remote agents rather than watched continuously. Routine processes can be automated, leaving people more time for ambiguous problems that require judgment.

Incident mode
スライド 5 / 6Incident modeThe example lists the agent’s investigation and reporting actions.

In incident mode, Agent Chip joins an incident channel and investigates logs, traces, the affected service and code. It is designed to give humans high-signal findings rather than flood the channel with speculation, while people control how much support it provides.

In internal ask channels, the agent can use knowledge sources to draft answers for a human or sometimes resolve a request itself. If it needs more context, a person can be brought into the conversation.

Data-quality on-call
スライド 6 / 6Data-quality on-callAgent Chip investigates alerts and can prepare a draft fix.

Agent Chip On Call investigates data-quality alert failures. A proactive version also examines backend changes for possible downstream data effects before the next batch runs. These are examples of the team’s workflows, not guarantees that all errors will be caught.

A Slack entry point also lowers the barrier for non-specialists. A business user can ask for a draft based on feedback or an idea; the draft can be tested in staging before an engineer reviews and deploys it. The speakers say the engineering review standard remains in place.

05

Why build in-house

A composable platform can evolve with models and use cases.

Why continue building in-house as the market changes? Monzo sees a reusable, composable platform component that is integrated with its own security and backend requirements. The architecture is designed to be provider-agnostic, so the model can be changed to fit a task.

The team also wants agents to cover more of the development lifecycle, from backend and app changes to staging and data tests. They are not claiming they must keep Agent Chip forever; their argument is that the accumulated platform capabilities have value today and make future use cases easier.

同じチャンネルの記事

スライド 9 枚21:32EN
AI Engineer· 2026年10月29日Shy Ruparel on AI agent reliability and recovery after failuresShy Ruparel · TemporalTemporal’s survey finds a gap between frequent agent use and dependable deployment. Ruparel demonstrates a synthetic payout workflow that resumes after workers stop.エージェントオブザーバビリティと信頼性エージェント工学+2
スライド 7 枚14:50EN
AI Engineer· 2026年10月29日Cole Gannaway on code review, cross-repository risk and AI software factoriesCole Gannaway · QodoA one-line rename can pass local checks while affecting distant clients. Qodo’s Cole Gannaway explains how review context, shared rules and independent agents can expose those risks.Code review & verificationコーディングエージェント開発ワークフローとテスト+2
スライド 5 枚11:47EN
AI Engineer· 2026年10月29日Revolut’s David Abitbol on self-hosting AI coding models at scaleDavid Abitbol · RevolutAbitbol shares engineering delivery trends, GPU-serving costs and latency tuning, then describes controls for operating the tools in a regulated bank.Local inferenceAI cost & performanceDeveloper productivity+2
スライド 4 枚21:47EN
AI Engineer· 2026年10月28日Patrick Smyth on Open-Source Supply Chain Security in the AI EraPatrick Smyth · ChainguardChainguard’s Patrick Smyth discusses faster exploitation, malware in dependencies, zero-days and the expanding attack surface around developer workflows.CybersecurityOpen-source ecosystemsAI security+2
スライド 5 枚14:09EN
AI Engineer· 2026年10月28日Taylor Luttrell-Williams on Finding Logic Vulnerabilities with SonarQube Hunter AgentTaylor Luttrell-Williams · SonarSonar’s Taylor Luttrell-Williams explains how a security agent maps a codebase, investigates logic flaws and presents validated findings alongside conventional scans.CybersecurityAI securityCode review & verification+2
スライド 5 枚16:29EN
AI Engineer· 2026年10月28日Chris Vela on Benchmarking vLLM Configurations with Runpod BenchPodChris Vela · RunpodRunpod’s Chris Vela demonstrates a dashboard for comparing LLM serving configurations and choosing performance settings with workload-specific data.InferenceBenchmarksAI cost & performance+2