The first time I realized AI tools have “access gates”
Last Tuesday night, I was still in a Hangzhou café fixing a client’s automation script, preparing to hand a repetitive workflow over to AI. A friend sent me news that Goldman Sachs was restricting employees’ use of Claude Code. My first reaction wasn’t “finance is so strict,” but: if client files, contracts, or account details ended up in the wrong tool, could we cross the same line? I had never paid close attention to those restrictions before, so I spent an evening catching up.
This isn’t “AI doesn’t work”; it’s about where companies can use it
Claude Code is an AI coding tool that can help read code, modify files, and troubleshoot errors. Goldman Sachs reportedly began revoking access from some bankers and traders. The core issue isn’t that it suddenly stopped working; financial institutions have stricter requirements around sensitive data, audits, and approvals. When we take on side projects and client work, whether we can use a tool often depends on what information can enter it, whether our company permits it, and who is accountable when something goes wrong.
I know Chen Lan, a tax and accounting services founder in Suzhou who organizes corporate filing documents for businesses. She used to upload client spreadsheets directly to public AI tools. One day, in a shared workspace in Hangzhou, she realized that client names and bank transaction records shouldn’t be uploaded casually. She switched to testing with sample data first, then keeping sensitive sections on local devices. She has no technical background, but she created a “Can this tool hold client data?” checklist for every tool. The scenario is ordinary, but it does more to keep us out of trouble than watching a product launch.
Replicating these safety boundaries costs little today
I’d start with a zero-cost, roughly 30-minute tool inventory; no coding skills required. First, open the privacy or enterprise settings in the AI tools you currently use and look for options such as “Is data used for training?”, “How long are files retained?”, and “Can this be turned off?” If the wording is unclear, don’t upload the client’s original content yet. For budget, I’d give beginners two fallback options: use a company-provided account, which typically costs nothing to a few hundred dollars per month, or buy a professional plan for roughly $20–$100 per month. The technical bar is knowing the difference between “public examples” and “real client data,” then getting someone who understands the business to confirm it. Don’t migrate every file on day one; run a sanitized sample first and see whether it’s worth it.
How I’d arrange this at each stage
If I were just starting, I’d use a free tier and sample data, hold off on paying for premium features, and avoid trying to copy Goldman Sachs’s configuration. If I already had one or two clients, I’d create a separate “data checklist” for each one, classify names, contact details, contracts, and account information, and confirm authorization before uploading anything. If I were scaling, I’d put client confidentiality requirements into the team’s onboarding checklist and tool-use guide, while keeping a manual review step in the process. Not everyone needs this tool, and it’s fine not to try it now. But when it comes to client data, I’ve found that clarifying the boundaries early is usually less stressful than cleaning up the damage afterward.