1 min lesson
The 15 to 20 minute demo, in order
Name the eight steps from ticket to merge and the person or control each step addresses.
Step 1 of 2
One run can answer the main question for each person in the room:
- The developer sees a ticket move into read-only exploration in Ask modeA read-only mode for asking questions about a codebase without changing files; the safe way to explore unfamiliar or legacy code. Press Enter for the full definition..
- The staff engineer reviews the plan before a small change is made under Project RulesVersion-controlled instructions in the repo that every Cursor agent interaction inherits, so standards are encoded once. Press Enter for the full definition..
- QA and security see a meaningful test, an auditable diff and attached evidence.
- The auditor and release lead see automated review and a failing CI gate while a person keeps control of the merge.
Learn the order well enough to return to it after an interruption.
Take a real ticket to a reviewable pull request. At each step, explain the work, show the evidence and name the control. The figure gives the order. The table maps each step to the person it matters to and the control to mention.
Interactive diagram. Tab through its regions; each focused region shows its detail in the panel below.
diagram: demo-spine
Move from ticket to evidence and review in order. A human owns the merge at the final step.
Learn more
Advanced table
Eight steps and their controls
- Step
- Ticket intake
- Lands on
- PM / delivery lead
- Control you name
- Value-stream traceability
- Step
- Ask modeA read-only mode for asking questions about a codebase without changing files; the safe way to explore unfamiliar or legacy code. Press Enter for the full definition. explore
- Lands on
- Senior / staff eng
- Control you name
- Understand-before-touch review is a reviewer practice, not an access control
- Step
- Reviewable Plan
- Lands on
- Staff eng
- Control you name
- Separation of duties requires intent review before execution
- Step
- Change under Project RulesVersion-controlled instructions in the repo that every Cursor agent interaction inherits, so standards are encoded once. Press Enter for the full definition.
- Lands on
- Architect / security
- Control you name
- Policy-as-config guardrail
- Step
- Meaningful tests
- Lands on
- QA / senior eng
- Control you name
- Quality gate
- Step
- Diff → PR + evidence
- Lands on
- Auditor / compliance
- Control you name
- ITGCIT General Controls. The baseline IT controls auditors check: who can change what, how changes get approved and how systems are run. Press Enter for the full definition. evidence, AI-code tracking
- Step
- BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition. under reviewers
- Lands on
- Security / eng lead
- Control you name
- Automated review, human approval
- Step
- Failing CI triage
- Lands on
- Release manager / auditor
- Control you name
- Merge gate, human holds the key
| Step | Lands on | Control you name |
|---|---|---|
| Ticket intake | PM / delivery lead | Value-stream traceability |
| Ask modeA read-only mode for asking questions about a codebase without changing files; the safe way to explore unfamiliar or legacy code. Press Enter for the full definition. explore | Senior / staff eng | Understand-before-touch review is a reviewer practice, not an access control |
| Reviewable Plan | Staff eng | Separation of duties requires intent review before execution |
| Change under Project RulesVersion-controlled instructions in the repo that every Cursor agent interaction inherits, so standards are encoded once. Press Enter for the full definition. | Architect / security | Policy-as-config guardrail |
| Meaningful tests | QA / senior eng | Quality gate |
| Diff → PR + evidence | Auditor / compliance | ITGCIT General Controls. The baseline IT controls auditors check: who can change what, how changes get approved and how systems are run. Press Enter for the full definition. evidence, AI-code tracking |
| BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition. under reviewers | Security / eng lead | Automated review, human approval |
| Failing CI triage | Release manager / auditor | Merge gate, human holds the key |