Metric Design & Product Sense
Defining north-star, guardrail and counter-metrics for an agent harness
The metric taxonomy
After this you can distinguish north-star, guardrail, counter, leading and lagging metrics and name when each one applies.
Reliability is a feeling until you give it a number. This seat exists to turn that feeling into a metric system an engineer could query tomorrow.
Cursor measures itself in user↔AI interactions at billions-per-period scale and the product is non-deterministic. The first thing the metric-design round checks is whether you reach for a single vanity number or a structured family of metrics that hold each other honest. A strong answer names the family before it names any one metric.
Interactive diagram. Tab through its regions; each focused region shows its detail in the panel below.
The north-star is the product of these stage SLIs - not their average.
- Metric type
- North-star
- What it does
- The single clearest expression of sustained value
- Reliability example at Cursor
- Share of agent runs that complete successfully inside a latency budget
- Metric type
- Guardrail
- What it does
- Must not degrade while you optimize the north-star
- Reliability example at Cursor
- Cost per run, p99 latency, support-ticket rate
- Metric type
- Counter-metric
- What it does
- Catches the cheat that would game the north-star
- Reliability example at Cursor
- False-accept rate of bad edits, silent truncation rate
- Metric type
- Leading
- What it does
- Moves at deploy time, before users feel it
- Reliability example at Cursor
- Canary success rate, post-deploy error-rate delta
- Metric type
- Lagging
- What it does
- Confirms real outcome days or weeks later
- Reliability example at Cursor
- Weekly retained-active, churn linked to a bad run
| Metric type | What it does | Reliability example at Cursor |
|---|---|---|
| North-star | The single clearest expression of sustained value | Share of agent runs that complete successfully inside a latency budget |
| Guardrail | Must not degrade while you optimize the north-star | Cost per run, p99 latency, support-ticket rate |
| Counter-metric | Catches the cheat that would game the north-star | False-accept rate of bad edits, silent truncation rate |
| Leading | Moves at deploy time, before users feel it | Canary success rate, post-deploy error-rate delta |
| Lagging | Confirms real outcome days or weeks later | Weekly retained-active, churn linked to a bad run |
Name the family, then defend your one north-star inside it.
Picking a defensible north-starone number, heavily qualified
A good reliability north-star bundles three things into one definition: an outcome users care about, a quality bar and a time bound. "Agent success rate" alone is too loose. Share of agent runs that reach an accepted edit within the latency budget, measured over a rolling 7-day window is something a query can return.
Notice what that definition refuses to do. It does not reward a run that finishes fast but produces a rejected edit and it does not reward a correct edit that arrived after the user gave up. The bar and the time bound are both load-bearing.
Decompose into a driver treethe north-star as a product of queryable inputs
A north-star you can only observe is hard to act on. A north-star you can decompose tells engineers exactly where to look when it moves. Break it into the harness stages that multiply into it.
- Retrieval
- context assembled correctly and within budget
- Model TTFT
- time to first token inside threshold
- Tool-call success
- each tool invocation returns valid, non-error output
- Edit-apply success
- proposed diff applies cleanly to the file
- User acceptance
- the edit is kept, not undone or re-prompted
Each row is its own SLI; the product of them is the north-star.
Every metric you name must be defined precisely enough that an engineer could write the query tomorrow without asking you a follow-up. "Latency" is not a metric. "p99 of model-first-token-ms, by client version, over a rolling hour" is. The interviewer is listening for that level of specificity.
When asked to define a reliability metric, say the family first, then commit to one north-star, then immediately list the two guardrails that keep it honest. That sequence signals you have shipped a metric system before, not just defined a KPI for a deck.
A north-star with no counter-metric invites gaming. If "success rate" can be raised by making the agent answer less ambitiously, you have built an incentive to ship a worse product. Always pair the optimization target with the thing it would quietly sacrifice.
Takeaway. Lead with the family - north-star plus guardrails plus a counter-metric - and define each one precisely enough to query tomorrow.
Self-check
QAn interviewer asks you to propose a single reliability metric for the agent. What distinguishes a strong answer from a weak one?
Reliability SLIs, SLOs and error budgets
After this you can speak the reliability-engineering dialect - SLI, SLO, error budget - and compose targets across a multi-step harness.
Engineers on a Performance & Reliability team talk in SLIs, SLOs and error budgets. If you want them to adopt your metric, define it in their language.
- SLI
- the measured signal - p99 completion latency, agent success rate
- SLO
- the target you commit to - p99 ≤ 8s for 99% of runs
- Error budget
- the allowed shortfall - the 1% you may spend before you stop shipping
SLI is what you measure, SLO is the promise, error budget is the slack.
The error budget is the part candidates skip and the part that makes the metric powerful. It converts a target into a shipping policy. When the budget is healthy, teams ship fast. When it is spent, the policy says slow down and stabilize. The DS who owns the SLI quietly influences release cadence.
Choosing the percentilewhy p50 lies and the tail tells the truth
Reliability pain lives in the tail. A p50 that looks great can hide a p99 where one user in a hundred waits 30 seconds and abandons. Those abandoners churn loudest and complain hardest.
- Percentile
- p50
- What it captures
- the typical, healthy run
- What it hides
- every painful tail event
- Percentile
- p95
- What it captures
- the edge of normal
- What it hides
- the worst 1-in-20 experiences
- Percentile
- p99
- What it captures
- the tail where frustration concentrates
- What it hides
- the rare catastrophic outliers
- Percentile
- p99.9
- What it captures
- catastrophic stalls and timeouts
- What it hides
- almost nothing - but it is noisy
| Percentile | What it captures | What it hides |
|---|---|---|
| p50 | the typical, healthy run | every painful tail event |
| p95 | the edge of normal | the worst 1-in-20 experiences |
| p99 | the tail where frustration concentrates | the rare catastrophic outliers |
| p99.9 | catastrophic stalls and timeouts | almost nothing - but it is noisy |
Track p50 for health and p99 for pain; do not report a mean for latency.
Composing SLOs across the harnessthe chain is only as reliable as its weakest stage
An agent run is a pipeline: retrieval, then model, then tool-call, then apply. End-to-end reliability is the product of the stage reliabilities, not the average. Four stages at 99% each compose to roughly 96% end-to-end and that gap is where users feel the product fail.
Interactive diagram. Tab through its regions; each focused region shows its detail in the panel below.
End-to-end success rests on every stage below it - multiply, never average.
end_to_end = retrieval * model * tool_call * apply
= 0.99 * 0.99 * 0.99 * 0.99
≈ 0.961 # ~3.9% of runs fail somewhereThis math is why a single end-to-end SLO is not enough. You need per-stage SLIs so the weakest link is visible and an error budget allocated across stages so no one stage silently eats the whole budget.
A latency SLO that ignores correctness rewards an agent that returns fast garbage. Encode quality into the success definition: a run only "succeeds" if the edit was both timely and accepted. Speed without quality is a regression wearing a green dashboard.
“I'd define the SLI as p99 end-to-end run latency with an accepted edit, set the SLO at the level our worst-tolerable experience demands and use the error budget as the lever for release cadence - when it's spent, we stabilize before we ship.”
Do not quote a mean latency in this round. Latency distributions are heavy-tailed, so a mean is dominated by outliers and means nothing operationally. Reaching for an average here signals you have not worked with real telemetry.
Takeaway. SLI is the signal, SLO is the promise, error budget is the shipping lever - and reliability across a harness multiplies, so track per-stage and never report a latency mean.
Self-check
QFour harness stages each run at 99% reliability. Why can the end-to-end agent-run reliability still feel unacceptable and what does that imply for SLO design?
Measuring a non-deterministic agent
After this you can design population-level success and quality metrics for stochastic agent outputs without ground truth.
You cannot grade a single agent run the way you grade a unit test. The same prompt can produce a brilliant edit once and a wrong one the next. Measure the population, not the run.
Cursor's product is non-deterministic by design, so the metric has to be statistical from the start. Define success as a rate over many runs - share of runs that reach an accepted, correct edit - and watch its distribution and variance, not a single trace.
Proxy signals when there is no ground truththe user is your grader, implicitly
Most runs have no labeled "correct" answer. The user's behavior after the run is the closest thing to a label you get. Read it carefully.
Edit accepted and kept across the session.
No immediate re-prompt on the same task.
User continues working in the same file.
Edit undone within seconds.
Re-prompt or rephrase of the same ask.
Abandonment or a follow-up correction.
No single proxy is trustworthy alone. Undo can mean "wrong" or "I changed my mind." The pattern across signals, segmented and tracked over time, is what carries the truth.
Model regression vs. harness regressionpage the right team
When the success metric drops, the most valuable thing you can do is attribute it. A model regression means the outputs got worse. A harness regression means the loop got slower or flakier while the model is fine. They page different teams and conflating them wastes the on-call.
- Symptom
- Acceptance rate drops, latency flat
- Likely model regression
- yes - output quality fell
- Likely harness regression
- no
- Symptom
- Latency and timeout rate spike, acceptance flat
- Likely model regression
- no
- Likely harness regression
- yes - loop or tools degraded
- Symptom
- Tool-call error rate jumps
- Likely model regression
- rarely
- Likely harness regression
- yes - harness or integration
- Symptom
- Drop isolated to one model version
- Likely model regression
- yes - model rollout
- Likely harness regression
- no
| Symptom | Likely model regression | Likely harness regression |
|---|---|---|
| Acceptance rate drops, latency flat | yes - output quality fell | no |
| Latency and timeout rate spike, acceptance flat | no | yes - loop or tools degraded |
| Tool-call error rate jumps | rarely | yes - harness or integration |
| Drop isolated to one model version | yes - model rollout | no |
Hold one axis fixed to separate output quality from loop health.
A success metric that rewards short, safe answers will quietly train the product to be useless. If "no undo within 10s" defines success, the agent learns to make timid edits no one bothers to revert. Always ask: what would a lazy optimizer do to my metric and does that path make the product worse?
Offline eval vs. online telemetrytwo truths that sometimes disagree
- Offline eval
- controlled, repeatable, labeled - trust for pre-ship gating and regression catches
- Online telemetry
- real users, real repos, real distribution - trust for what actually happens in production
- When they disagree
- usually your eval set is unrepresentative; treat the gap as a signal to fix the eval, not to dismiss telemetry
When asked how you'd measure agent quality, refuse the single-run framing out loud: "You can't grade one run - it's stochastic, so I'd define a population success rate and triangulate with acceptance, undo and re-prompt as proxies." Naming the stochastic nature first is the senior signal in this round.
Scope the ask before you build the metricclarify, then implement
Half the bad metrics come from a vague request answered too fast. "Build me a reliability chart" hides a dozen decisions: which population, which window, how to handle multiple user IDs, which domains to include. The strongest practitioners force those decisions to the surface before they write a line of query.
Cursor bakes this in. Plan modeA mode that makes no edits: it researches the codebase and produces an editable plan you review before any code changes. ships with an ask-clarification tool that surfaces questions before it builds - it triggers on its own when a prompt is vague, or you can invoke it explicitly. One DS leans on it hard enough that they wrote a skill to make it non-optional.
It surfaced exactly the questions a metric owner should ask first - how should charts handle multiple user IDs, which extra domains to include - before drawing anything.
“I actually have a skill that tells Cursor that anytime you use plan mode, ask me at least six or seven questions before going in and making the plan.”
Takeaway. Grade the population, not the run: combine acceptance, undo and re-prompt as proxies, separate model from harness regressions and stress-test every success definition against gaming.
Self-check
QThe agent-run success metric drops sharply. Acceptance rate fell but latency and tool-call error rates are flat. What does this point to and who should be paged?
Slicing and the traps
After this you can avoid the classic metric-design mistakes - Simpson's paradox, survivorship bias, heavy tails - that interviewers probe for.
An aggregate metric is where pain goes to hide. The metric-design round will hand you a number that looks healthy and watch whether you trust it or interrogate it.
The reflex they want is segment before you conclude. A global success rate of 94% can mask a brand-new client version sitting at 60% or one model that is quietly failing on large repos. The aggregate is an average of experiences and averages drown out the people who are suffering.
Dimensions to slice by defaultbefore you report any reliability number
The four trapsnamed, with the tell for each
- Trap
- Simpson's paradox
- How it bites
- Global metric improves while every segment worsens, due to mix shift
- Defense
- Always check segment-level trends, not just the aggregate
- Trap
- Survivorship / selection bias
- How it bites
- Users who churned from a bad run stop logging events, so the survivors look fine
- Defense
- Track cohorts from a fixed entry point; don't condition on still-active
- Trap
- Heavy tails
- How it bites
- Means are dominated by outliers and hide where pain lives
- Defense
- Report medians and percentiles; watch variance, not central tendency
- Trap
- Mistaking volume for impact
- How it bites
- Ranking issues by raw event count buries a small group in severe pain
- Defense
- Rank by affected-user blast radiusHow much breaks if a change goes wrong; the scope of potential damage., not by event frequency
| Trap | How it bites | Defense |
|---|---|---|
| Simpson's paradox | Global metric improves while every segment worsens, due to mix shift | Always check segment-level trends, not just the aggregate |
| Survivorship / selection bias | Users who churned from a bad run stop logging events, so the survivors look fine | Track cohorts from a fixed entry point; don't condition on still-active |
| Heavy tails | Means are dominated by outliers and hide where pain lives | Report medians and percentiles; watch variance, not central tendency |
| Mistaking volume for impact | Ranking issues by raw event count buries a small group in severe pain | Rank by affected-user blast radiusHow much breaks if a change goes wrong; the scope of potential damage., not by event frequency |
If asked "the global metric went up, ship it?", do not say yes. Say: "Up globally can hide every segment going down if the traffic mix shifted - I'd confirm each major segment moved the same direction before I conclude." That single sentence is what the round is fishing for.
Rank by blast radius, not by countthe JD says this explicitly
One of this role's named responsibilities is to identify the experiences causing disproportionate user frustration and quantify their blast radiusHow much breaks if a change goes wrong; the scope of potential damage.. That phrasing is deliberate. The loudest log line is not the worst problem.
- Issue A
- 200k transient retries, auto-recovered, zero abandonment - high count, low impact
- Issue B
- 3k runs that hard-fail on large monorepos, 40% of those users churn - low count, high blast radiusHow much breaks if a change goes wrong; the scope of potential damage.
- Right call
- fix B first; rank by affected-user impact, not raw events
Blast radius = users affected × severity × likelihood of churn.
Interactive diagram. Tab through its regions; each focused region shows its detail in the panel below.
The loudest log line is usually not the worst problem.
“Before I conclude from an aggregate, I segment by model, client version and repo size and I check for mix shift. Then I rank issues by blast radiusHow much breaks if a change goes wrong; the scope of potential damage. - how many users hit it and how badly - not by raw event volume.”
Takeaway. Segment before you conclude, watch for mix shift and survivorship in logs, report percentiles over means and rank problems by blast radiusHow much breaks if a change goes wrong; the scope of potential damage. rather than event count.
Self-check
QYour global agent-success rate rose 2 points after a release. An interviewer asks if you'd ship the change broadly. What is the rigorous response?
Operationalizing the metric
After this you can show you can drive adoption of a metric - instrument it, make it trusted and wire it into a real decision.
Defining a metric is the easy half. The skill the JD actually screens for is operationalizing one: making it instrumented, trusted and wired into a decision the org will not override.
This role's requirement is a track record of operationalizing a north-star across a product pillar - driving adoption and decisions from it, not just authoring a definition. The interview wants the second half. A metric nobody checks is a comment in a doc.
- Instrumented
- the event schema exists, the metric computes reliably, backfilled and monitored
- Trusted
- one source of truth; teams argue about reality, not whose number is right
- Wired into a decision
- a dashboard people check, an alert that pages, a gate that blocks a release
All three or it is a definition, not a metric.
The path from definition to decisionthe order matters
- 1Define precisely. Outcome, quality bar, time window - concrete enough to query tomorrow.
- 2Build the data contract. Event schema, ownership, backfill and data-quality checks so the number stays trustworthy as the product changes.
- 3Establish one source of truth. Put the metric in a semantic/metric layer so every dashboard derives from the same definition.
- 4Wire it into a ritual. A weekly reliability review, a release-readiness gate, an incident retro template.
- 5Close the loop. Show one case where the metric changed a decision or triggered a rollback, then keep that story.
Interactive diagram. Tab through its regions; each focused region shows its detail in the panel below.
A metric only earns its keep at the gate that blocks a ship.
Self-serve so you are not the bottlenecka named responsibility
Cross-functional empathy here means making engineers self-sufficient instead of gatekeeping data. The metric layer, the dashboards and the query interfaces exist so an engineer can answer their own reliability question at 2am without filing a ticket to you. The win is when people stop asking you and start asking the dashboard.
Spec the metric as a code-linked, reviewable docthe workflow, not just the definition
The old way to spec a metric change was a design doc in Notion or Drive, disconnected from the code it described. Cursor's plan mode loads the plan beside the code, so a step can point at the exact file and snippet it will touch. You edit the plan directly - delete a chart step and the agent drops it, add a step to ask for a test or a different cut. Check the plan into git and it becomes a reviewable paper trail your team can argue over before any query runs.
You can run several plans at once through separate non-conflicting agents - a notebook and a web app drawing from the same DB - without them stepping on each other.
“I would always have the technical design doc in Notion or Google drive and I wouldn't be able to actually be like here's the code I want to change. With plan mode you'll have everything in one place.”
The same surface handles the messy front end of metric work. Cursor takes image inputs, so a team can photograph their hand-drawn architecture sketches and have it convert them to Mermaid - one customer published the result straight to FigJam. It is strong at pulling a sprawling Excel sheet into a notebook too: point it at a funding spreadsheet and ask for a Jupyter notebook querying that data. Hand it a creative, open-ended task and it reaches for a built-in brainstorming skill on its own.
A metric the org distrusts is worse than no metric, because every meeting devolves into arguing about the number instead of the problem. Data-quality checks, clear ownership and a single source of truth are not hygiene - they are what make the metric usable as a decision input at all.
Have one concrete story ready: a metric you built, the decision it changed or the rollback it triggered and how you got the org to trust it. Name the ritual it lived in. "We caught a p99 regression in the Thursday reliability review and held the release" lands far harder than "I'm metrics-driven."
Before the onsite, write your operationalization story and check it answers four things: what the metric was, how you made it trustworthy, the exact decision it drove and what would have happened without it. If any of the four is vague, the interviewer will find the gap.
“Operationalizing it meant three things: a data contract so the number was trustworthy, a single source of truth so we stopped debating definitions and a release-readiness gate so the metric actually blocked a ship when the error budget was spent.”
Takeaway. Operationalized means instrumented, trusted and wired into a decision - and your strongest interview asset is one true story of a metric you built changing a real decision.
Self-check
QA candidate says "I'd define a north-star metric for reliability." What is the most senior follow-up they should have anticipated and how should they answer it?