1 min lesson
The 15 to 20 minute demo, in order
Use "Learn the order well enough to return to it after an interruption" to say what you would do next.
Step 1 of 2
One run can answer a different question for each person in the room.
Learn the order well enough to return to it after an interruption.
Take a real ticket to a reviewable pull request. At each step, explain the work, show the evidence and name the control. The figure gives the order. The table maps each step to the person it matters to (the developer and staff engineer early, QA, security and the auditor in the middle, the release lead at the gate) and the control to mention.
Interactive diagram. Tab through its regions; each focused region shows its detail in the panel below.
Move from ticket to evidence and review in order. A human owns the merge at the final step.
Learn more
Advanced table
Step
- Step
- Ticket intake
- Lands on
- PM / delivery lead
- Control you name
- Value-stream traceability
- Step
- Ask modeA read-only mode for asking questions about a codebase without changing files; the safe way to explore unfamiliar or legacy code. Press Enter for the full definition. explore
- Lands on
- Senior / staff eng
- Control you name
- Understand-before-touch review is a reviewer practice, not an access control
- Step
- Reviewable Plan
- Lands on
- Staff eng
- Control you name
- Separation of duties requires intent review before execution
- Step
- Change under Project RulesVersion-controlled instructions in the repo that every Cursor agent interaction inherits, so standards are encoded once. Press Enter for the full definition.
- Lands on
- Architect / security
- Control you name
- Policy-as-config guardrail
- Step
- Meaningful tests
- Lands on
- QA / senior eng
- Control you name
- Quality gate
- Step
- Diff → PR + evidence
- Lands on
- Auditor / compliance
- Control you name
- ITGCIT General Controls. The baseline IT controls auditors check: who can change what, how changes get approved and how systems are run. Press Enter for the full definition. evidence, AI-code tracking
- Step
- BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition. under reviewers
- Lands on
- Security / eng lead
- Control you name
- Automated review, human approval
- Step
- Failing CI triage
- Lands on
- Release manager / auditor
- Control you name
- Merge gate, human holds the key
| Step | Lands on | Control you name |
|---|---|---|
| Ticket intake | PM / delivery lead | Value-stream traceability |
| Ask modeA read-only mode for asking questions about a codebase without changing files; the safe way to explore unfamiliar or legacy code. Press Enter for the full definition. explore | Senior / staff eng | Understand-before-touch review is a reviewer practice, not an access control |
| Reviewable Plan | Staff eng | Separation of duties requires intent review before execution |
| Change under Project RulesVersion-controlled instructions in the repo that every Cursor agent interaction inherits, so standards are encoded once. Press Enter for the full definition. | Architect / security | Policy-as-config guardrail |
| Meaningful tests | QA / senior eng | Quality gate |
| Diff → PR + evidence | Auditor / compliance | ITGCIT General Controls. The baseline IT controls auditors check: who can change what, how changes get approved and how systems are run. Press Enter for the full definition. evidence, AI-code tracking |
| BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition. under reviewers | Security / eng lead | Automated review, human approval |
| Failing CI triage | Release manager / auditor | Merge gate, human holds the key |
Learn more
Optional practice
Test yourself on The 15 to 20 minute demo, in order
QWhich pairing matches the Reviewable Plan step of the demo?