Capital One builds risk scoring infrastructure for agentic code

Capital One is developing an internal risk scoring infrastructure to govern the deployment of AI-generated code and the actions of long-running agents. The bank’s strategy treats risk management as a platform responsibility, automatically applying controls such as prompt injection guardrails and cyber reviews via a self-built AI gateway, rather than placing that burden on individual developers. The company has implemented a multi-agent code review system where distinct agents check architectural integrity, cyber security, and stylistic compliance, with verifier agents validating the results.

While this AI-first review precedes human approval, Capital One maintains a human-in-the-loop for software deployment to ensure high governance standards. The risk scoring system integrates production telemetry, including live incident data and code sensitivity, to determine whether a change can be deployed automatically behind a feature gate or requires manual escalation. This approach allows the bank to balance the speed of AI-driven development with the regulatory requirements of the financial sector, moving beyond simple token usage metrics to measure actual product delivery outcomes.

Abhijit Bose argues that governance should be an amplifier for engineering teams by centralizing risk controls on the platform, allowing developers to focus on building rather than managing compliance. He states that risk scoring is the critical next step for safe agentic deployment.