Goldman Sachs restricts Claude Code access for most staff

Builders evaluating Claude Code or similar agents must decide whether to isolate execution in controlled cloud environments. An illustrative scenario: a team building an internal code assistant first checks whether their current endpoint deployment allows long-lived credentials that an agent could read. They record the exact credential lifetime and any existing audit coverage. If the review shows exposure windows longer than a few minutes, they test a cloud-hosted version with short-lived tokens before any production rollout. The supplied evidence does not establish whether Goldman Sachs or other firms have published their exact token policies or test results.

Operators must weigh eligibility rules and data-handling requirements before expanding agent access. An illustrative scenario: a compliance team reviews which employee groups can retain agent tools under current policy. They document the productivity metrics cited for the exempt quantitative staff versus the restricted groups and compare them against the credential exposure risks listed in the Replit advisory. The review also checks whether any vendor has published retention periods for logs generated by agents running on employee devices. The evidence does not establish how many other financial institutions have adopted identical restrictions.