TL;DR

Barclays’ principal AI engineer, Andy McMahon, has set out how one of Britain’s largest banks is preparing autonomous agents for production — and almost none of it concerns model capability. His three priorities are observability, permission boundaries and the ability to stop an agent programmatically. Barclays sits inside the FCA’s AI Live Testing programme alongside UBS and Lloyds.

Confidence, not capability

Speaking on The Brave Technologist podcast, McMahon named observability as the first requirement for putting agents into production: “how do you capture telemetry metrics, logs, traces for your agent and agentic solutions”. Without traces, an engineer cannot reconstruct why an agent did what it did, which means testing effectively stops at release.

The practical consequence is that production becomes part of the test cycle rather than its endpoint. That mirrors work Barclays has already done on shift-left testing, where global performance engineering lead Manik Sikka pushed observability across the bank’s engineering practice.

Bounded autonomy

McMahon is blunt about limits. “You can’t just give an AI agent like carte blanche to do what it wants,” he said. “You can’t give it like access to all of your tools, all of your systems.” The answer is designed constraint — scoped permissions, agent identities, and, in his phrasing, kill switches implemented “programmatically” rather than kept as an emergency lever.

That reframes what quality means. Functional correctness is no longer sufficient; recoverability and controllability now count as engineering requirements.

He also rejects the notion that any of this needs a new stack. Kubernetes, identity providers, MLOps and existing observability tooling all still apply: “It’s the same technologies with new spins.”

Looking forward

The value here is that it is attributable. Most agentic-AI governance material is vendor abstraction; this is a named engineer at a named UK bank describing controls his employer actually runs.

It also lines up with where UK supervision is heading. The FCA’s AI Live Testing looks past model accuracy at governance, oversight and operational controls — the same list McMahon works from. Last week’s Treasury adoption plan widened what banks must evidence, and Singapore has told its banks that an AI policy is not itself a control. Firms that already produce telemetry will find those requirements cheap. Firms that do not will be rebuilding while being asked to prove.