Your most disciplined engineer is now a machine. Not your smartest one. Your most disciplined one.

That distinction matters more in a regulated bank than almost anywhere else, because in banking the thing examiners actually inspect is not how clever the code is. It is whether the process around the code was followed every time. Was there a test. Was the change documented. Is there a pull request that explains what changed and why. Was the risk assessed before the merge. These are not engineering niceties. They are the evidence that your software development lifecycle is what your control framework says it is.

Here is the uncomfortable part. Most engineers are inconsistent at exactly those things. Not because they are bad at their jobs, but because discipline is the first casualty of a deadline. The test gets skipped because the feature works on the demo. The pull request body says “fixes bug.” The decision that will matter in an audit eighteen months from now lives in someone’s memory and nowhere else. A well-instructed agent does not have a 5pm on a Friday. It writes the test, fills the template, and records the reasoning every single time, because that is what it was told to do.

Discipline Is the Compliance Surface

Strip away the vocabulary and a bank’s SDLC controls are a discipline checklist. Every change traceable to a ticket. Every merge gated by review. Every deployment backed by a rollback plan. Every material decision written down where an examiner can find it. The whole apparatus exists to prove one thing: that a human did not skip a step.

That is the frame that makes agentic coding interesting for regulated shops, and it is not the frame the vendors sell. The pitch is always speed. Speed is the least valuable thing an agent gives a bank, because a bank’s bottleneck was never typing. I made that argument at length in The Bottleneck Was Never the Code. The valuable thing is that the agent treats the disciplined path as the only path. It does not experience the control step as friction to be routed around. It experiences it as part of the task.

When compliance is discipline, the machine’s defining weakness in creative work, that it does exactly and only what it is told, becomes its defining strength.

What Agents Do By Default, and What Humans Skip

Point an agent at a change and tell it the standard. It generates the unit tests. It writes a pull request description that actually describes the diff. It leaves comments where the logic is non-obvious. It produces an architecture decision record if you asked for one. It runs the checks and reports what it found before you look. None of that is remarkable to the agent. It is the same amount of “effort” as the code itself.

Now watch a rushed human do the same change. The code ships. The test is a TODO. The PR body is one line. The decision is undocumented. Six months later nobody can reconstruct why the retry logic uses that specific backoff, and the person who knew has moved teams. The work got done. The evidence that it was done correctly did not get created.

I want to be precise here, because the honest version of this argument is stronger than the marketing version. Agents do not write cleaner code. CodeRabbit’s analysis of 470 pull requests found AI-authored PRs averaged 10.83 issues each versus 6.45 for human-only work, roughly 1.7 times as many, with logic errors and security gaps overrepresented. The raw output has more defects, not fewer. What agents do reliably is the process around the output: the test that catches the defect, the review pass that surfaces it, the documentation that makes it fixable. Discipline is not the absence of mistakes. It is the machinery that catches them before production.

The Data Says Discipline Is the Mitigation

Google’s 2024 State of DevOps report found something that should worry any bank rushing AI into delivery: a 25% increase in AI adoption was associated with an estimated 7.2% decrease in delivery stability and a 1.5% decrease in throughput. More AI, less stable software. But the report does not conclude “don’t use AI.” It prescribes the fix directly: smaller batch sizes and robust automated testing.

Read that again through the compliance lens. The prescribed mitigation for AI’s stability hit is exactly the disciplined process a bank already requires and an agent already performs by default. Small, traceable changes. Comprehensive tests. Verification before merge. The machine’s native behavior is the countermeasure the data says you need.

The adoption of that machinery is already happening. Jellyfish tracked code-review-agent adoption climbing from 14.8% to 51.4% across 2025, alongside a 113% jump in pull requests per engineer and a 24% drop in median cycle time. The volume of change is going up. The only way a regulated shop absorbs that volume without drowning its examiners is if the discipline scales with it. Humans do not scale discipline under pressure. That is precisely when they abandon it.

The Agent Is a Better Audit Citizen

Think about what an examiner actually wants from your engineering organization. Not brilliance. Predictability. A process that produces the same artifacts, in the same order, with the same rigor, regardless of who was on call or how close the deadline was. Consistency is the entire point of a control.

By that standard, a well-instructed agent is a better audit citizen than most of your engineers. It never decides the test is optional. It never leaves the change record for later. It never rationalizes skipping the review because “it’s a small change.” The behaviors that make an engineer a compliance risk, all of them variations on cutting a corner under pressure, are behaviors the machine does not have.

This reframes what you are actually buying when you bring agents into a regulated delivery pipeline. You are not buying a faster typist. You are buying a floor under your process discipline that does not erode at the end of the quarter. Your compliance problem was rarely a policy gap. The policy is written. The problem is the gap between the policy and what tired humans do on a Friday. The machine closes that gap by construction. This is the same logic behind treating documentation as the code and building the compliance tax into the workflow instead of bolting it on afterward.

The Part I Can’t Make Easy

Discipline is not judgment, and this is where the argument has to stay honest.

An agent that flawlessly follows a wrong process produces perfectly documented, fully tested, immaculately reviewed garbage. A disciplined wrong answer is still wrong. The 1.7x defect rate from CodeRabbit is not a footnote; it is the reason the review step has to be real. If your engineers treat agent-generated pull requests the way a rubber stamp treats paper, the discipline is theater. The machine filled the template. It did not verify that the change was correct. That verification is still human work, and it is harder now, not easier, because the volume went up and the output looks polished enough to lull you.

There is also a measurement trap. METR’s randomized trial found experienced developers were 19% slower with AI tools while believing they were 20% faster, a 39-point gap between perception and reality. If your own engineers cannot feel whether AI helped, you cannot run this on vibes. You need the artifacts, the tests, the review findings, the change records, precisely because human self-assessment is unreliable. The discipline is not just for the examiner. It is the only trustworthy signal you have about your own throughput.

And discipline you did not verify is a liability dressed as an asset. “The agent produced a full test suite” means nothing if nobody checked that the tests assert the right thing. Coverage is not correctness. A green pipeline over untrue assertions is worse than no pipeline, because it manufactures confidence you did not earn. I keep coming back to this in the gap between doing the work and proving it: the proof is only worth what the verification behind it is worth.

Where This Leaves You

The machine gives you a discipline floor. It does not give you a judgment ceiling. Those are different problems, and conflating them is how organizations end up with beautifully compliant systems that do the wrong thing.

The move for a regulated engineering shop is to let the agent own the discipline it is genuinely better at, the tests, the traceability, the documentation, the never-skipped control step, and reinvest the human hours you free up into the verification and judgment the machine cannot do. Not into shipping more. Into checking harder. The agent raised the floor on process. Your people should be raising the ceiling on correctness. That is the division of labor that survives an audit and a production incident at the same time.

The engineers who resisted AI because “it doesn’t understand our codebase” were arguing about the wrong axis. The question was never whether the machine writes better code than they do. It writes buggier code, measurably. The question is whether it follows the process better than they do under deadline. It does. And in a bank, following the process is not the boring part of the job. It is the job.

If this landed, you’ll want Everything Is Skill Issue, on why the real bottleneck to AI in an engineering org is organizational, not technical, and Judgment Is the New Moat, on what humans are left holding when execution goes to zero.

Find me on X @orestesgarcia or LinkedIn.