1 min lesson
The agent surface and matched guardrails per rung
Put this idea into your own words: "There is no single 'agent'."
Step 1 of 2
There is no single 'agent.'
There's a ladder of surfaces, from near-zero autonomy to fully headless and each rung needs guardrails matched to its blast radiusHow much breaks if a change goes wrong; the scope of potential damage. Press Enter for the full definition.. The mistake teams make is applying laptop-grade trust to async, multi-repo execution. The worse mistake is starting at the top of the ladder.
Interactive diagram. Step through it with the Next and Previous controls below, or Tab to a region to read its detail.
Each rung up adds reach and removes a human from the loop, so each rung up must add controls. Higher autonomy is conditional on evidence plus controls, never the start.
Learn more
Advanced table
Surface to guardrail mapping
- Rung
- 1
- Surface
- Tab / inline completion
- Human in loop?
- Every keystroke
- Matched guardrails
- Rules; trivial blast radiusHow much breaks if a change goes wrong; the scope of potential damage. Press Enter for the full definition.
- Rung
- 2
- Surface
- IDE agent - Ask / Plan
- Human in loop?
- Reviews plan before acting
- Matched guardrails
- Rules + MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. read scopes; plan reviewed before execution
- Rung
- 3
- Surface
- CLI - plan / ask / debug
- Human in loop?
- Drives interactively in terminal
- Matched guardrails
- Command allowlist + terminal sandboxing; interactive /debug
- Rung
- 4
- Surface
- Headless in CI
- Human in loop?
- Pipeline gates, async
- Matched guardrails
- Locked allowlist, hooks, scoped CI creds, required checks
- Rung
- 5
- Surface
- Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition. - isolated VMs
- Human in loop?
- Async, parallel multi-repo
- Matched guardrails
- VM isolation, scoped permissions, audit logs, MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. allowlist
- Rung
- 6
- Surface
- SDK / fully headless
- Human in loop?
- Programmatic, no interactive human
- Matched guardrails
- All of the above + deny-by-default, tight egress, mandatory review on merge
| Rung | Surface | Human in loop? | Matched guardrails |
|---|---|---|---|
| 1 | Tab / inline completion | Every keystroke | Rules; trivial blast radiusHow much breaks if a change goes wrong; the scope of potential damage. Press Enter for the full definition. |
| 2 | IDE agent - Ask / Plan | Reviews plan before acting | Rules + MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. read scopes; plan reviewed before execution |
| 3 | CLI - plan / ask / debug | Drives interactively in terminal | Command allowlist + terminal sandboxing; interactive /debug |
| 4 | Headless in CI | Pipeline gates, async | Locked allowlist, hooks, scoped CI creds, required checks |
| 5 | Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition. - isolated VMs | Async, parallel multi-repo | VM isolation, scoped permissions, audit logs, MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. allowlist |
| 6 | SDK / fully headless | Programmatic, no interactive human | All of the above + deny-by-default, tight egress, mandatory review on merge |
Surface to guardrail mapping. Verified surfaces: CLI /debug; Cloud Agents with isolated VMs, parallel multi-repo, async runs.
Notice the inversion. As the human leaves the loop, the configuration has to carry the trust the human used to provide. At rung 1 a typo is nothing. At rung 6 a misconfigured egress rule is an incident. Guardrails don't stay constant up the ladder. They intensify in lockstep with reach.
Autonomy and control move together. Every rung that removes a human from the loop must add a control that takes their place: a tighter allowlist, a hook, an isolation boundary, a required review on merge. If reach goes up and controls stay flat, that's the gap I'd close first.
Learn more
Optional practice
Practice: The agent surface and matched guardrails per rung
QMultiple choice: Moving an agent from the IDE (Plan modeA mode that makes no edits: it researches the codebase and produces an editable plan you review before any code changes. Press Enter for the full definition., human reviews each plan) to async Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition. doing parallel multi-repo work. What MUST change about guardrails?