1 min lesson
A concrete least-privilege pilot config for a SOX repo
Name the parts in "A concrete least-privilege pilot config for a SOX repo" and give the practical job of each one.
Step 1 of 2
A concrete least-privilege pilot config for a SOX repodeny-by-default
SOXSarbanes-Oxley Act. A US law that forces companies to keep auditable controls over any system that affects their financial reporting. Press Enter for the full definition. repos govern financial reporting controls. Segregation of duties and change-evidence are non-negotiable. The agent can be a force multiplier here, but it starts maximally clamped and earns nothing on day one beyond proposing changes a human reviews.
SOX pilot - starting posture
- Privacy
- Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. + ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition. on (note: ZDR is not available with your own API keys).
- Rules
- Nested AGENTS.md: 'no schema/migration changes without human author', coverage + contract-test requirements, repository-pattern boundaries.
- MCP
- Read-only allowlist: Jira (read), Confluence runbooks (read). No write or action servers in the pilot.
- Commands
- Deny-by-default. Allow only: test runner, linter,
git status/diff. Blocklist infra CLIs, package publish, network fetch. - Hooks
- Pre-commit secret scan; block writes outside the service dir; log every tool call.
- Execution
- Terminal sandboxed; autonomous work runs in isolated Cloud Agent VMs with scoped, short-lived creds.
- Merge gate
- Agent never merges. Mandatory human review plus a separate approver to preserve segregation of duties. Audit logs + AI-code tracking on.
Least privilege isn't paranoia in a SOX repo. It's the auditable baseline you expand FROM.