1 min lesson
Set up a SOX pilot
Choose a restricted starting setup that preserves review evidence and separation of duties.
Step 1 of 2
Start with least privilege in a SOX repositorydeny by default
A repository covered by SOXSarbanes-Oxley Act. A US law that forces companies to keep auditable controls over any system that affects their financial reporting. Press Enter for the full definition. controls needs clear change evidence and separation between the author and approver. Start the agent with permission to propose a change, run approved checks and open a pull request. Keep merge approval with people.
Starting controls for a SOX pilot
- Privacy
- Enforce Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. for the team. If the team uses its own model API keys, check the provider agreement because Cursor's zero data retention terms do not govern that path.
- Rules
- Use versioned rules for test requirements, architecture boundaries and changes that always need a human author.
- MCP
- Approve only read access to the Jira tickets and Confluence runbooks needed by the pilot.
- Commands
- Set the team Run Mode to Auto-review, keep a narrow auto-run allowlist and block unnecessary network access.
- Hooks
- Use hooks to scan for secrets, stop writes outside the service directory and record sensitive tool calls.
- Execution
- Sandbox supported local commands. Run cloud work in a dedicated VM with scoped credentials and restricted egress.
- Merge gate
- The agent does not merge. Require human review and a separate approver, with audit logs enabled.
Begin with a small, reviewable set of permissions and expand it only after the pilot provides evidence.