Capstone, the interview spine & self-assessment
The structures you fall back on when a question is ambiguous.
The spine: one page you never abandon under pressure
After this you can run the 7-beat spine in order from memory and recover your place after any interruption.
Everything you've learned compresses into one structure you can run from memory when the room gets hostile, the VP interrupts or you blank. The spine is a load-bearing skeleton, not a script. Seven beats, in order, that turn a messy enterprise conversation into a coherent path from where work waits today to what gates the expansion.
Why a spine and not talking points? Under pressure you don't lose your facts. You lose your order.
You start defending a feature before you've established the risk it has to respect. You quote a metric before anyone agreed on the baseline. The spine fixes sequence so each beat earns the right to the next. Master it and you can be interrupted at beat 4, dragged back to beat 2 and still know exactly where you are.
Interactive diagram. Tab through its regions; each focused region shows its detail in the panel below.
Run it in order. Current → Risk → Use case → Cursor fit → Pilot → Proof → Expand. Each beat is a question you answer before advancing. The closing message rides on top of all seven.
"I don't sell AI everywhere. I find where work waits, name what has to hold and earn the next ring of rollout with evidence. That's the whole job."
The spine is a risk-respecting value argument. Beats 1–3 establish the problem and its constraints. Beat 4 is your only product moment. Beats 5–7 are controlled proof and earned expansion.
If you ever feel yourself pitching features, you've skipped to beat 4 without finishing beats 1–3. Stop and back up.
The recurring closing message rides on top of all seven: the work is to expand autonomy as fast as the evidence allows and not one ring faster. That single line reframes every objection (speed, security, cost, skepticism) as a question about evidence and guardrails rather than a fight about whether AI is good.
Takeaway. Run the seven beats in order: each one earns the right to the next, so an interruption never loses you your place.
Self-check
Beat-by-beat: what each move actually does
After this you can open each beat with its best question and name the specific control or metric that beat reaches for.
Knowing the seven labels isn't the skill. The skill is knowing what work each beat does and the single best question that opens it. Below is the operating detail behind each beat, with the named controls and metrics you reach for.
Opener: "Walk me through your value streamThe end-to-end path a change takes from idea to running in production.. Where does a change wait the longest?"
You're hunting the queue: review backlog, env provisioning, cross-team handoffs, ticket aging. DORADORA metrics. Four widely-used delivery measures: deployment frequency, lead time for changes, change failure rate and time to restore service.'s lead-time-for-changes lives here. No queue named means no problem to solve.
Opener: "What can never bend, even for velocity?"
Separation of duties, ITGCIT General Controls. The baseline IT controls auditors check: who can change what, how changes get approved and how systems are run., change-management controls, the regulated boundaries. You name these before product so the room knows you respect them. This beat is how you earn the right to be in an enterprise.
Opener: "If we fixed one workflow first, which one moves the needle?"
One repo, one team, one workflow with a clear edge. Bounded means measurable and measurable means safe. 'AI everywhere' is the anti-pattern: no baseline, infinite blast radiusHow much breaks if a change goes wrong; the scope of potential damage..
Opener: "Here's why this tool fits that workflow and respects those controls."
Context (codebase awareness, MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs.), Rules (.cursor/rules, model/repo allowlists), Control (hooks, sandboxing, audit logs, RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually., SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool./SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave.). Your one product moment.
Opener: "We start with a cohort, guardrails on, blast radiusHow much breaks if a change goes wrong; the scope of potential damage. scoped."
Model/MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs./repo allowlists, hooks, terminal sandboxing, Privacy ModeCursor's setting that routes requests under zero-data-retention terms so providers don't store or train on your code., audit logs all enabled. Box's mentorship model (+75% usage in 6 weeks) is the template.
Opener: "We measured before we changed, so we can show the delta."
DORADORA metrics. Four widely-used delivery measures: deployment frequency, lead time for changes, change failure rate and time to restore service. four keys, throughput, migration-effort reduction (Box: 80–90% less), daily-active. No baseline means no proof, just vibes.
The most common failure is collapsing beats 3 and 4: describing the tool as the use case. 'The use case is Cursor' is not a use case. The use case is 'cut PR review wait time on the payments repo for the platform team.' Cursor is how you address it.
Second most common: skipping beat 2 with a regulated buyer. If you reach beat 4 and they haven't heard you name separation of dutiesNo single person can author, approve and deploy the same change. The core control AI autonomy has to respect. or ITGCIT General Controls. The baseline IT controls auditors check: who can change what, how changes get approved and how systems are run., you've already lost the security lead in the room.
Beat 6 is only as strong as the numbers behind it, so frame ROIReturn on Investment. The value gained versus what it cost, the language an economic buyer funds deals in. as a maturity journey rather than one headline stat you'd have to defend: qualitative (are devs reaching for it) → quantitative (PR velocityHow quickly pull requests are merged; the easiest delivery metric to measure, though it sits furthest from the customer outcome., bug counts, share of code the agent turns over) → dollars.
The dollars framing that lands with executives is pull-forward revenue: collapsing a deployment from weeks to days pulls roadmap revenue forward. Lead with the axis, then attach whatever numbers you can source and verify - never a figure you can't stand behind under a follow-up.
When a beat needs the security one-pager, name it precisely: Privacy ModeCursor's setting that routes requests under zero-data-retention terms so providers don't store or train on your code. on by default and cannot be turned off, zero-data-retention agreements with all major model providers, SOC 2 Type II, SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. + MDM enforcement, code never leaves the US - point them to trust.cursor.com. The own-API-keys ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. caveat still applies exactly as stated in the drills.
Beat 7 deserves its own disciplineexpansion is earned
Beat 7, Expand, is where weak reps invent a timeline ('then we roll out org-wide in Q3') and strong reps name a gate. A gate is a condition: 'when the pilot cohort holds DORADORA metrics. Four widely-used delivery measures: deployment frequency, lead time for changes, change failure rate and time to restore service. change-fail rate flat while lead time drops 20%, we expand to the next two teams.' Conditions are defensible. Dates are hostages.
Organizations (GA to Enterprise ~June 2026) is the structural answer to 'expand':
- One admin plane over many teams, each with its own governance and budget.
- Groups for cohort-level model access and spend.
When an interviewer asks 'how do you expand a successful pilot?' they're testing whether you'll say a date or a gate. Answer with a gate every time, then name Organizations/Groups as the mechanism that lets each new ring keep its own security, governance and budget.
Takeaway. Never collapse beat 3 into beat 4: the use case is a bounded workflow you can measure and Cursor is only how you address it.
Self-check
QMultiple choice - Which statement is a real use case (beat 3), not a disguised product pitch (beat 4)?
The 10 capstone drills
After this you can run the spine through any of the ten standard loop scenarios and land at least one named control, feature or number.
These are the ten scenarios you will face, in some form, in a Cursor Field Engineer loop. The bar is 8 of 10 fluent: you can run the spine through each one and name specific controls, features and metrics, not generic reassurance.
Fluent means three things:
- It rules out hedging.
- It bans 'it depends' unless you give the fork.
- It requires at least one named artifact (a control, a feature, a number) in every answer.
- #
- 1
- Drill
- Skeptical VP ('AI is hype')
- The spine move that wins it
- Beat 1+6: name where work waits, then offer to prove it with a baselined pilot. Move the fight onto evidence. Cite 64% of the Fortune 500 as social proof, never as the argument itself.
- #
- 2
- Drill
- Regulated rollout (finance/health)
- The spine move that wins it
- Beat 2 first, loudly: separation of dutiesNo single person can author, approve and deploy the same change. The core control AI autonomy has to respect., ITGCIT General Controls. The baseline IT controls auditors check: who can change what, how changes get approved and how systems are run., audit logs, SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool./SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave., RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually., Privacy ModeCursor's setting that routes requests under zero-data-retention terms so providers don't store or train on your code. + ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it., AWS PrivateLinkAn AWS feature that keeps traffic to a service on your private network instead of the public internet.. Then bounded pilot inside the boundary.
- #
- 3
- Drill
- Security lead evaluation
- The spine move that wins it
- Beat 2+5: SOC 2 Type II, AES-256 at rest, TLS 1.2+, annual pen test, model/MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs./repo allowlists, hooks, terminal sandboxing, AI-code tracking. Note ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. does NOT apply with your own API keys.
- #
- 4
- Drill
- Discovery simulation
- The spine move that wins it
- Beats 1–3 only. Resist demoing. Find the queue, the controls, the bounded slice. Earn beat 4.
- #
- 5
- Drill
- 'BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. is just noise'
- The spine move that wins it
- Beat 6: the durable number is that BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. consistently resolves north of 70-80% of the issues it finds - it is high signal-to-noise by design. Custom rules via .cursor/BUGBOT.md tune what it flags. (Perishable June-2026 figures: ~90-second average review, ~10% more bugs, ~22% lower run cost - verify before quoting.) Tune it, don't defend it.
- #
- 6
- Drill
- Mixed pilot results
- The spine move that wins it
- Beat 6+7: segment the cohort. Find who succeeded and why (mentorship, Box's +75% in 6 weeks), then gate expansion on replicating that rather than on averages.
- #
- 7
- Drill
- Enterprise demo design
- The spine move that wins it
- Beat 4 narrated against beat 3. Demo the bounded use case with controls visible: allowlists, audit log, a hook firing. Never a generic feature tour.
- #
- 8
- Drill
- 'Copilot/this is free'
- The spine move that wins it
- Beat 1+6: free tools don't move lead time; outcomes do. Teams Standard/Premium pricing is trivial against a throughput gain when the workflow works (Box: 30–50%).
- #
- 9
- Drill
- Senior-engineer objection
- The spine move that wins it
- Beat 5: autonomy is dialed, not dumped. The hard guarantee: no automation agent ever merges directly - it always produces a human-reviewed PR, and the person clicking merge is accountable. Sandboxing, review gates and AI-code tracking keep the senior in control. The agent removes toil, not judgment.
- #
- 10
- Drill
- Autonomy boundary
- The spine move that wins it
- Beat 2+5: name the autonomy ladder via the foreground-vs-background rule. Foreground = decisions (interactive, ambiguous, watched); background = execution with clear acceptance criteria. The test: if the output is verifiable through an artifact (video, screenshot, logs, diff), push it async; if fuzzier, stay foreground. Enforced by hooks, sandboxing and SoDSeparation of Duties. No single person can author, approve and deploy the same change. The core control AI autonomy has to respect.. Blast radius is a setting, not a hope.
| # | Drill | The spine move that wins it |
|---|---|---|
| 1 | Skeptical VP ('AI is hype') | Beat 1+6: name where work waits, then offer to prove it with a baselined pilot. Move the fight onto evidence. Cite 64% of the Fortune 500 as social proof, never as the argument itself. |
| 2 | Regulated rollout (finance/health) | Beat 2 first, loudly: separation of dutiesNo single person can author, approve and deploy the same change. The core control AI autonomy has to respect., ITGCIT General Controls. The baseline IT controls auditors check: who can change what, how changes get approved and how systems are run., audit logs, SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool./SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave., RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually., Privacy ModeCursor's setting that routes requests under zero-data-retention terms so providers don't store or train on your code. + ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it., AWS PrivateLinkAn AWS feature that keeps traffic to a service on your private network instead of the public internet.. Then bounded pilot inside the boundary. |
| 3 | Security lead evaluation | Beat 2+5: SOC 2 Type II, AES-256 at rest, TLS 1.2+, annual pen test, model/MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs./repo allowlists, hooks, terminal sandboxing, AI-code tracking. Note ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. does NOT apply with your own API keys. |
| 4 | Discovery simulation | Beats 1–3 only. Resist demoing. Find the queue, the controls, the bounded slice. Earn beat 4. |
| 5 | 'BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. is just noise' | Beat 6: the durable number is that BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. consistently resolves north of 70-80% of the issues it finds - it is high signal-to-noise by design. Custom rules via .cursor/BUGBOT.md tune what it flags. (Perishable June-2026 figures: ~90-second average review, ~10% more bugs, ~22% lower run cost - verify before quoting.) Tune it, don't defend it. |
| 6 | Mixed pilot results | Beat 6+7: segment the cohort. Find who succeeded and why (mentorship, Box's +75% in 6 weeks), then gate expansion on replicating that rather than on averages. |
| 7 | Enterprise demo design | Beat 4 narrated against beat 3. Demo the bounded use case with controls visible: allowlists, audit log, a hook firing. Never a generic feature tour. |
| 8 | 'Copilot/this is free' | Beat 1+6: free tools don't move lead time; outcomes do. Teams Standard/Premium pricing is trivial against a throughput gain when the workflow works (Box: 30–50%). |
| 9 | Senior-engineer objection | Beat 5: autonomy is dialed, not dumped. The hard guarantee: no automation agent ever merges directly - it always produces a human-reviewed PR, and the person clicking merge is accountable. Sandboxing, review gates and AI-code tracking keep the senior in control. The agent removes toil, not judgment. |
| 10 | Autonomy boundary | Beat 2+5: name the autonomy ladder via the foreground-vs-background rule. Foreground = decisions (interactive, ambiguous, watched); background = execution with clear acceptance criteria. The test: if the output is verifiable through an artifact (video, screenshot, logs, diff), push it async; if fuzzier, stay foreground. Enforced by hooks, sandboxing and SoDSeparation of Duties. No single person can author, approve and deploy the same change. The core control AI autonomy has to respect.. Blast radius is a setting, not a hope. |
"BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. isn't noise you tolerate. It's signal you tune. Cursor's June 2026 update brought the average review to about 90 seconds and custom rules in .cursor/BUGBOT.md let the team shape exactly what it flags. If it's noisy, that's a config conversation, not a verdict."
Drill 3 trap: a security lead will ask 'do you retain our data?' If the customer brings their own API keys, zero-data-retention does not apply. The retention terms then ride on the model provider, not on Cursor. Saying 'we never retain anything' when they use their own keys is a credibility-ending error. Get this distinction exactly right.
Several perishable BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. speed, cost and pre-merge-resolution stats are directional and dated. Use the June 2026 average-review-time, bug-find and cost claims only after checking current Cursor materials.
BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. June-2026 figures (~90-second average review, 22% lower run cost, ~10% more bugs), Teams Standard/Premium pricing and enterprise thresholds. Treat these as perishable: confirm against current Cursor materials before you say them out loud.
Takeaway. Pass the loop at 8 of 10 fluent. Every answer carries a named control, feature or metric, with the ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. own-keys caveat stated exactly right.
Self-check
QMultiple choice - A security lead asks: 'Does Cursor retain our prompts and code?' Your team uses its own model API keys. What's the precise answer?
Final self-assessment: the 10 capabilities
After this you can score yourself honestly on the ten live capabilities and pick the two to drill before a loop.
Before you walk into a loop, score yourself honestly against these ten. Each is a capability you perform live, not a fact you recite. The bar for each: could you do this in front of a skeptical buyer, right now, without notes?
- 1Run the full 7-beat spine cold, in order, on a use case you've never seen and recover when interrupted.
- 2Open discovery and stay in beats 1–3 without demoing, finding the queue and the controls.
- 3Name the enterprise control surface from memory: SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool./SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave., RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually., model/MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs./repo allowlists, hooks, terminal sandboxing, audit logs, AI-code tracking.
- 4State the security posture precisely: SOC 2 Type II, AES-256 at rest, TLS 1.2+, annual pen test, Privacy ModeCursor's setting that routes requests under zero-data-retention terms so providers don't store or train on your code. + ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. (and the own-keys caveat), PrivateLinkAn AWS feature that keeps traffic to a service on your private network instead of the public internet./Cloudflare Tunnel.
- 5Map a customer's value streamThe end-to-end path a change takes from idea to running in production. to DORADORA metrics. Four widely-used delivery measures: deployment frequency, lead time for changes, change failure rate and time to restore service.'s four keys and identify which one the pilot will move.
- 6Design a guardrailed pilot: cohort, allowlists on, sandboxing on, audit on, baseline captured.
- 7Articulate the autonomy ladder (unattended vs. gated vs. forbidden) and how hooks/SoDSeparation of Duties. No single person can author, approve and deploy the same change. The core control AI autonomy has to respect. enforce it.
- 8Convert any objection (hype, free, security, skeptical senior) into an evidence-and-guardrails question.
- 9Quote proof responsibly: Box (85%+ DAU, 30–50% throughput, 80–90% less migration effort) and 64% of Fortune 500, while flagging perishable stats as verify-before-quoting.
- 10Define expansion as a gate, not a date and tie it to Organizations/Groups.
8 of 10 fluent is the pass bar. 'Fluent' means you perform the capability live, with at least one named artifact, without hedging. If you can recite a capability but can't perform it under a follow-up question, score it half.
Your weakest two are your prep list. Don't broaden. Go deep on the two you'd most fear being asked to do live.
Takeaway. Score performance, not recall, then spend your prep going deep on your weakest two capabilities instead of broadening across all ten.
Self-check
Portfolio artifacts: the proof you bring
After this you can map the seven portfolio artifacts to the spine and pick the two that lead every loop.
Talk is beat 4. The portfolio is beats 5 and 6 made tangible: artifacts that prove you've actually done the work, not just memorized the vocabulary. Seven pieces, mapped to the spine. In a loop, the candidate who opens a real current-state map beats the candidate who describes one.
Bring artifact 01 (current-state map) and artifact 05 (pilot plan with guardrails) to every loop. They most cleanly demonstrate the discipline interviewers screen for: finding the queue and scoping the blast radiusHow much breaks if a change goes wrong; the scope of potential damage.. The other five support; these two lead.
Interactive diagram. Tab through its regions; each focused region shows its detail in the panel below.
Each artifact answers one spine beat. Artifacts 01 (current-state map) and 05 (pilot plan) are flagged violet. Bring those two to every loop; the rest support.
- Discovery round
- Artifacts 01 + 02: show you find the queue and the controls before pitching.
- Solution round
- Artifacts 03 + 04: bounded use case plus concrete config, never a feature tour.
- Rollout round
- Artifacts 05 + 06: guardrailed pilot and baselined proof.
- Whiteboard / closing
- Artifact 07: run the spine and 10 drills from memory.
A portfolio of polished slides with no baseline is a tell that you've never run a real pilot. The artifact interviewers probe hardest is 06: 'show me the baseline you measured against.' An outcomes readout with outcomes but no documented before-state reads as marketing, not evidence.
Takeaway. Lead every loop with artifact 01 (current-state map) and artifact 05 (guardrailed pilot plan); the deepest probe lands on 06's baseline.
Self-check
QMultiple choice - Which two portfolio artifacts should you bring to every loop and why?
The mindset to walk in with
After this you can hold the risk-respecting posture under pressure and compress the whole course into one walk-in sentence.
The spine, the drills, the artifacts all rest on one posture: you are not there to sell AI. You're there to expand autonomy as fast as the evidence allows and not one ring faster. Walk in as the person who makes risk smaller, not the person who makes it go away by ignoring it.
The strongest Field Engineers in the room sound less like a vendor and more like a careful internal champion the customer wishes they already had. They lead with the customer's constraints rather than the product's capabilities. They say 'no' to a bad use case faster than they say 'yes' to a good one.
A failed unbounded pilot poisons the whole account. A small proven one earns the next ring.
Never argue whether AI is good. Argue what the baseline shows and what the pilot proved. Every fight moves onto the evidence axis.
Don't ask the customer to trust autonomy. Show them blast radiusHow much breaks if a change goes wrong; the scope of potential damage. is a setting: allowlists, hooks, sandboxing, audit. It's enforced, not hoped.
One proven ring beats ten promised ones. Say no to 'AI everywhere' faster than yes to a clean slice. Expansion is the reward you earn, not the plan you open with.
"My job isn't to make your risk disappear. It's to make it small enough to measure, then earn the next ring of autonomy with evidence. I'll say no to a bad use case faster than I'll say yes to a good one."
If you remember nothing else: lead with where work waits, name what must hold, scope the smallest proof and expand only as fast as the evidence allows. That one sentence is the spine, the mindset and the close at once. Everything else is detail hung on that frame.
Close the loop the way you'd close a customer. Lead with the recurring message, never a feature. Find where work waits. Name what must hold. Earn each ring with evidence. You can be interrupted, doubted, dragged off-script and still land there. That's what 'fluent' means and that's what walks you through the door.
Takeaway. You don't sell AI. You make risk small enough to measure and earn each ring with evidence. In one line: find where work waits, name what must hold, earn each ring with evidence.