1 min lesson
The agent surface: autonomy needs matching guardrails
Use "Cursor's agent surface is a ladder of increasing autonomy" to describe the practical rule.
Step 1 of 2
Cursor's agent surface is a ladder of increasing autonomy: inline Tab completions, the in-IDE agent, the CLI agent, cloud agents in isolated cloud VMs, and the SDK for programmatic automation.
The governing law: every step up in autonomy demands a step up in guardrails. Each rung gives the agent more blast radiusHow much breaks if a change goes wrong; the scope of potential damage. Press Enter for the full definition. between human checkpoints and your controls have to cover that gap.
Interactive diagram. Step through it with the Next and Previous controls below, or Tab to a region to read its detail.
Each rung up requires the prior rung's controls plus new ones: sandboxing, allowlists, plan gates and audit.
Learn more
Advanced table
Read the middle column top to bottom and you have the arc
- Surface
- Tab
- Human posture
- In the loop, every keystroke
- Guardrail that must scale up
- Trivial; you accept/reject inline
- Surface
- IDE agent
- Human posture
- In the loop, reviews the diff
- Guardrail that must scale up
- Plan-first, scoped context, you watch it run
- Surface
- CLI
- Human posture
- On the loop
- Guardrail that must scale up
- Terminal sandboxing, command allowlists
- Surface
- Cloud agents
- Human posture
- On/off the loop
- Guardrail that must scale up
- Repo/model/MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. allowlists, no standing prod creds, audit logs
- Surface
- SDK
- Human posture
- Out of the loop at runtime
- Guardrail that must scale up
- Policy-as-code, hooks, Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. and ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition. terms, hard scoping
| Surface | Human posture | Guardrail that must scale up |
|---|---|---|
| Tab | In the loop, every keystroke | Trivial; you accept/reject inline |
| IDE agent | In the loop, reviews the diff | Plan-first, scoped context, you watch it run |
| CLI | On the loop | Terminal sandboxing, command allowlists |
| Cloud agents | On/off the loop | Repo/model/MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. allowlists, no standing prod creds, audit logs |
| SDK | Out of the loop at runtime | Policy-as-code, hooks, Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. and ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition. terms, hard scoping |
Read the middle column top to bottom and you have the arc: in the loop, then on the loop, then out of the loop at runtime.
Autonomy and guardrails move together or you have a problem.
High autonomy with low control is how you get a 2 a.m. incident. Pile heavy control on a trivial task and you've just bought friction. The art is matching the rung to the risk tier of the work.
Match the rung to the risk tier
A typo fix in a docs file and a change to the payments authorization path are not the same risk tier and they shouldn't get the same autonomy. Low-risk, well-tested surfaces can run further up the ladder with a lighter touch. High-risk, regulated paths stay low on the ladder, gated by a reviewed plan, mandatory human review and tight allowlists. The cloud agents' isolation (separate VMs, no standing production credentials) is precisely what lets you grant autonomy without granting blast radiusHow much breaks if a change goes wrong; the scope of potential damage. Press Enter for the full definition..
Learn more
Optional practice
Practice: The agent surface: autonomy needs matching guardrails
QWhat's the principle that governs how Cursor's agent surfaces (Tab → IDE → CLI → cloud → SDK) should be deployed on a team?