Foundations: the lens you carry all week

Forget the IDE for a second.

You walk into a large company's existing engineering system and show two concrete things:

• Where an AI coding tool makes good changes easier to produce.
• Where it makes evidence cheaper to generate.

You do both without breaking a single control that someone relies on to pass an audit or keep their job.

The buyer is rarely the developer who loves the product. It's a VP of Engineering or a CISOChief Information Security Officer. The executive who owns security; usually the hardest and most important person to win over. who got burned by the last tool that promised speed and shipped them audit findings. They already run a delivery system that works. It's imperfect and expensive, but it ships and it passes SOXSarbanes-Oxley Act. A US law that forces companies to keep auditable controls over any system that affects their financial reporting.. Your credibility starts with respecting that system and the fastest way to lose the room is to tell them it's broken.

Hold both halves at once. Easier to produce is the developer-joy story: the demo, the velocity, the reason a champion shows up. Cheaper to evidence is the executive story: a trustworthy audit trail and logs that prove exactly what the AI touched. Tell only the first and you sound like every other vendor in the bake-off.

Every large engineering org runs a delivery system, whether or not anyone has drawn it. You can break it into five layers. Four are flow: work moving from idea to running software. The fifth is a control plane that spans the other four. Carry this lens all week. In any customer environment you map their tools onto the layers and ask one question of each: does Cursor make this layer better or is this a layer I must not touch?

The four flow layerswhere Cursor adds impact

Layer 5 - the control planespans all four; you respect it, you never bypass it

Layer 5 isn't a flow layer. It's the set of controls cutting across the other four to satisfy regulators and auditors:

• separation of dutiesNo single person can author, approve and deploy the same change. The core control AI autonomy has to respect. (the author can't also approve and deploy)
• ITGCIT General Controls. The baseline IT controls auditors check: who can change what, how changes get approved and how systems are run. (access, change and operations controls)
• an audit trail
• access control
• data residency

In a SOXSarbanes-Oxley Act. A US law that forces companies to keep auditable controls over any system that affects their financial reporting.-relevant shop these aren't optional and they aren't yours to redesign.

Keep one reference account in your head all week, so every abstract point has a concrete home. Northstar Financial is our running example: a 200-engineer fintech, SOXSarbanes-Oxley Act. A US law that forces companies to keep auditable controls over any system that affects their financial reporting.-relevant, running the kind of messy large-company stack you'll actually meet. Each time you learn a concept, ask 'how would I say this to Northstar?'

Map that stack onto the five layers and the conversation organizes itself.

The control plane is the part to read carefully. SOXSarbanes-Oxley Act. A US law that forces companies to keep auditable controls over any system that affects their financial reporting. means whoever authors a change can't single-handedly approve and deploy it. At Northstar the CABChange Advisory Board. A group that reviews and signs off on higher-risk production changes before they ship. and the GitHub Enterprise approvals are that enforcement and Cursor leaves them exactly where they are. It just makes the change and the evidence around it, arrive faster.

Where Cursor lands at Northstar

• Engineering (L2): context-aware help across a 15-year Java monolith and modern TS services. The model carries codebase context a new engineer would take months to build.
• Release (L3): drafting and maintaining Terraform and Jenkins config; generating release notes and the change-ticket evidence the CABChange Advisory Board. A group that reviews and signs off on higher-risk production changes before they ship. needs.
• Operations (L4): triaging a Datadog alert, proposing a fix against the failing service, drafting the ServiceNow incident and postmortem.
• Control plane (L5): Cursor's audit logs and AI-code tracking make the SOXSarbanes-Oxley Act. A US law that forces companies to keep auditable controls over any system that affects their financial reporting. evidence cheaper to produce. The CABChange Advisory Board. A group that reviews and signs off on higher-risk production changes before they ship. still approves and GitHub Enterprise still enforces who can merge.

Aurora Health is the counterweight to Northstar. It's the account where you do not lead with your favorite feature, because the environment forbids it. Know only the easy case and you get caught flat in the room.

How the two accounts sharpen the lens

The discipline is identical in both rooms: read the control plane and the network posture before you choose what to show. Northstar's gate is compliance and separation of dutiesNo single person can author, approve and deploy the same change. The core control AI autonomy has to respect.. Aurora's gate is network and data residency. Tailoring the demo to whichever constraint is binding is the entire skill.

This week builds the lens first, then loads it with ammunition. Treat the five-layer model as the spine and everything else as muscle hung on it. Every module should resolve back to one question: where does this make good changes easier to produce or evidence cheaper to generate, without disturbing Layer 5?

1. 1Internalize the lens (this module). Five layers, the thesis, the two accounts. Can't draw the five layers from memory? You're not ready for the rest.
2. 2Run every later concept through the lens. BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. is engineering-flow impact with pre-merge review evidence. Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. are engineering/release autonomy, governed. Audit logs are Layer 5 made cheaper.
3. 3Anchor each concept to Northstar, then stress-test it against Aurora. If it only works at Northstar, you've found a constraint to flag, not a feature to lead with.
4. 4Practice the one-liners aloud. Interview-grade means saying the thesis and the SoDSeparation of Duties. No single person can author, approve and deploy the same change. The core control AI autonomy has to respect. line cleanly under pressure, not just recognizing them.
5. 5Separate the verified from the perishable. Know which stats are durable claims and which need 'verify before quoting.'

Enterprise credibility dies on a wrong number. Carry the verified facts precisely and label the perishable ones 'verify before quoting' instead of stating them as gospel. These are the load-bearing claims for the foundational pitch.

Agent surface & Bugbotcurrent, but mark dates

Pricing - directional only

• Teams Standard lists at $40 monthly or $32 annual per seat; Teams Premium lists at $120 monthly or $96 annual per seat with 5x Standard usage.
• Teams usage is split into Auto + ComposerCursor's own fast coding model, tuned for the editor and priced well below frontier models; the recommended day-to-day model for executing a plan. and third-party API pools.
• Enterprise is negotiated, with volume discounts at 100+ seats.
• Never quote enterprise pricing as a fixed number. State the list anchor and pivot to value.