Final self-assessment: the 10 capabilities

Before you walk into a loop, score yourself honestly against these ten. Each is a capability you perform live, not a fact you recite. The bar for each: could you do this in front of a skeptical buyer, right now, without notes?

1. 1Run the full 7-beat spine cold, in order, on a use case you've never seen and recover when interrupted.
2. 2Open discovery and stay in beats 1–3 without demoing, finding the queue and the controls.
3. 3Name the enterprise control surface from memory: SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition./SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition., RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition., model/MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition./repo allowlists, hooks, terminal sandboxing, audit logs, AI-code tracking.
4. 4State the security posture precisely: SOC 2 Type II, AES-256 at rest, TLS 1.2+, annual pen test, Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. + ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition. (and the own-keys caveat), PrivateLinkAn AWS connection Cursor uses for private Git provider and repository-origin traffic; it does not cover model-provider traffic. Press Enter for the full definition./Cloudflare Tunnel.
5. 5Map a customer's value streamThe end-to-end path a change takes from idea to running in production. Press Enter for the full definition. to DORADORA metrics. Four widely-used delivery measures: deployment frequency, lead time for changes, change failure rate and time to restore service. Press Enter for the full definition.'s four keys and identify which one the pilot will move.
6. 6Design a guardrailed pilot: cohort, allowlists on, sandboxing on, audit on, baseline captured.
7. 7Articulate the autonomy ladder (unattended vs. gated vs. forbidden) and how hooks/SoDSeparation of Duties. Short for separation of duties: the rule that authoring, approving and deploying a change never sit with one person. Auditors use the acronym; the control is the same. Press Enter for the full definition. enforce it.
8. 8Convert any objection (hype, free, security, skeptical senior) into an evidence-and-guardrails question.
9. 9Quote proof responsibly: Box (85%+ DAU, 30–50% throughput, 80–90% less migration effort) and 64% of Fortune 500, while flagging perishable stats as verify-before-quoting.
10. 10Define expansion as a gate, not a date and tie it to Organizations/Groups.