17 Jul 2026

Eighty-two merged pull requests. Forty-four hours median turnaround. Aspire's experiment with GitHub Agentic Workflows for cross-repository documentation is a genuinely useful data point, but the number that matters most isn't in the headline metrics.

It's the security architecture underneath.

The team gave their AI agents scoped permissions and kept human review in the loop. That might sound like table stakes, but in financial services it's the whole game. Any organisation running loan origination or credit decisioning infrastructure knows that the gap between "the AI did something useful" and "the AI did something auditable" is enormous. Regulators don't care how fast your documentation updated. They care who approved it and whether you can prove it.

What Aspire has actually demonstrated is a pattern worth studying:

• Agents operate within tightly bounded permissions, not open-ended access
• Output goes through human review before it merges
• The workflow produces an evidence trail by default

That last point is underappreciated. Documentation that updates automatically and leaves a commit history is more auditable than a Confluence page someone edited at 11pm before a deadline.

For UK consumer credit specifically, there's a practical application here that goes beyond developer productivity. FCA-regulated firms carry obligations around maintaining accurate records of system behaviour, particularly for AI-driven credit decisions under the Consumer Duty framework. Cross-repo documentation agents, built with proper permission scoping, could contribute to that compliance posture rather than undermine it.

The instinct in financial services is to treat AI automation as a risk to be managed. Sometimes that's right. But when the workflow is designed so that nothing merges without a human sign-off and every action is logged, you've built something that's arguably more controlled than your current manual process.

The question worth asking your engineering leads: if your documentation already lags your code by weeks, what's the actual risk reduction from keeping that process entirely human?

OpenAI and Anthropic building browsers into their agents is not a UX story. It's a distribution story, and UK consumer finance leaders need to treat it that way.

When an AI agent can navigate the web on a user's behalf, it becomes the interface. The agent searches, compares, applies, and follows up. The lender or broker sitting behind that agent is a data source, not a destination. That is a fundamental shift in where customer relationships begin and end.

Think about what that means for a credit broker. Today, we compete for traffic through SEO, paid search, and price comparison sites. Tomorrow, a user might simply tell their AI agent to find them the best personal loan for a home improvement project. The agent does the work. Our eligibility engine, our pricing, our product range gets interrogated without a human ever landing on our site. Conversion in the traditional sense stops existing.

The compliance question nobody is asking yet

The FCA's consumer duty rules require us to act in customers' best interests and communicate clearly. But if an AI agent is mediating that communication, who is responsible for what the customer understands? The agent summarises our product in its own words. We never approved that summary. The customer makes a decision based on it.

That is a regulatory gap that will need closing, and lenders and brokers who wait for the FCA to define it will find themselves reacting rather than shaping the answer.

The practical priority right now is making sure your systems can be interrogated cleanly by agents. Structured data, machine-readable eligibility criteria, APIs that return consistent outputs. If an agent hits your platform and gets a confusing or incomplete response, it moves on. The agentic web rewards technical clarity in ways that human-facing design never quite did.

The deeper question is whether brokers and lenders try to build their own agent layer, or accept that they sit underneath someone else's. Most will default to the latter through inaction. That is a choice worth making deliberately rather than by accident.

The agent-device repo is easy to scroll past. A CLI tool for mobile automation — sounds like a QA utility, something for the testing team to evaluate and probably deprioritise. That reading misses what's actually happening here.

What this represents is the infrastructure layer for agentic software doing its own verification work. An AI agent that can interact with a mobile app, capture evidence of what it did, and replay workflows is not a testing tool in the traditional sense. It's the scaffolding for autonomous software that can operate, check its own outputs, and demonstrate compliance with what it was supposed to do.

Why This Matters in Consumer Credit

Think about what UK consumer finance actually requires right now:

• Evidence that customer journeys met regulatory expectations at the point they happened
• Audit trails for automated decisioning that the FCA can inspect
• Consistent behaviour across every channel a customer might use

A loan origination platform handling affordability checks, consent capture, and pre-contractual disclosures needs to prove it behaved correctly for each application. Today that proof is largely assembled by humans reviewing logs. The direction agent-device points toward is systems that generate verifiable evidence of their own behaviour as a byproduct of operation.

There's a governance question buried in here that technology leaders should be thinking about now. When an AI agent can both execute a workflow and produce the evidence record for that workflow, who validates the validator? The tooling and the audit trail originate from the same system. That's not a reason to dismiss the approach — regulators will have to grapple with the same question regardless of what tools we build — but it's a design constraint worth building around from the start rather than retrofitting later.

The teams who treat agent-device as a QA curiosity will end up buying a more expensive version of this capability in two years from a vendor who packaged it properly. The teams who see it as an early signal about how autonomous systems will need to account for themselves have a genuine head start.