Part of It is easy to solve. For example, Our developer workstation have no access to the production network. This already solves issues beyond merely giving unattended agents access to production.

Then one can simply move the agents into something akin to cloud codespaces where they have only access to git, if at all.

Any access to data that is still needed can go through an authorised / authorising mcp proxy.

It doesn’t mean your bankers can’t use LLMs at all.