Mashreq gives coding agents its integration standards, not its payment rails. Inside a bank's IBM Bob pilot
Mashreq reports up to 60 to 70% less time on integration design and troubleshooting in an IBM Bob pilot, with agents reaching systems through an MCP gateway. What does it enforce?
Listen to this article · 5 min
AI-generated narration of the full article.
A coding assistant that knows Java is easy to find. One that knows how a particular bank names its message queues, which API standards its payments team enforces and how last quarter’s integration incident was resolved is rare. It is also the only kind that helps much in a bank’s integration team.
That is the bet behind a pilot IBM announced on October 12. Mashreq, a UAE-based bank, is testing IBM Bob across the integration engineering lifecycle: solution design and planning, development, code review and production troubleshooting. Early results, in the bank’s and IBM’s words, showed “up to a 60-70% reduction in the time spent on integration design and troubleshooting activities,” with some tasks that took two to three hours of manual effort completed in minutes.
The figures are early, vendor-announced and limited to those two activities. The architecture is the more interesting part.
Context is the product
The agents do not work from general knowledge alone. IBM Context Forge, an orchestration layer based on the Model Context Protocol, gives them access to the bank’s integration knowledge, API specifications, architecture standards and operational context. A secure gateway handles about 4,000 requests a month from AI agents to connected digital banking, payments and enterprise systems.
Behind that sits a production integration platform built on IBM Cloud Pak for Integration, IBM MQ, App Connect, API Connect, Red Hat OpenShift and Confluent, which averages 650 transactions per second across digital channels, payments and enterprise systems. That figure describes the platform’s traffic, not anything the agents do.
Two sides of the pilot
Engineering work where Bob is piloted
- Solution design and planning
- Development
- Code review
- Production troubleshooting
Agents draw context through Context Forge
Integration platform in production
- MQ, App Connect, API Connect
- Confluent on OpenShift
- About 650 transactions per second
The systems the engineering work changes
A gateway is not yet a permission model
The announcement describes “secure access” through the gateway. It does not say what the gateway enforces: whether agent access to connected systems is read-only, whose identity each request carries, which systems are in scope for troubleshooting, or how requests are logged and reviewed. Those are the details that decide whether this is controlled access or simply convenient access, and they are worth asking about before copying the design.
For a bank, the distinction matters. An agent that reads API specifications and architecture standards to draft an integration is low risk. An agent that queries a payments system to diagnose a production incident is reading live, sensitive data, under the identity of someone or something. As we argued in enterprise MCP starts with identity, every tool call needs a name behind it, and the gateway is where that name should be checked.
The same applies to output. Nothing in the announcement suggests agents change production systems on their own, and readers should not infer it. When an agent drafts an integration change, that change still has to pass the bank’s change process, which is where agent authorship should be recorded and approved.
Local models next
Mashreq is also exploring a future on-premises deployment of IBM Bob for mission-critical use cases, using locally hosted models to address data residency and regulatory requirements. That is an evaluation, not a commitment, but it follows the logic we described when IBM Bob went self-hosted: for regulated workloads, where the agent runs is part of the product decision.
Strip away the vendor names and the pilot offers a useful pattern for any regulated institution. Feed coding agents the organization’s own standards and specifications through one governed interface, measure the effect on specific engineering activities rather than on “productivity,” and keep the path from agent output to production running through the controls that already exist. The gateway’s rules are what turn that from a pilot into a design.