2 min lesson

Cursor enterprise controls, mapped to the threat model

Explain the order in "Cursor enterprise controls, mapped to the threat model", then say how you would verify the result.

Everything so far has been principle: assume the injection succeeds, bound the blast radiusHow much breaks if a change goes wrong; the scope of potential damage. Press Enter for the full definition. in code, starve the exit channels. This section names the actual Cursor enterprise controls that implement those principles, so when an interviewer asks "how would you enforce that?" you answer with a real mechanism, not a wish.

Four controls do most of the work: hooks, the model and MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. allowlist, Sandbox ModeAn isolated agent execution mode that contains the blast radius: file access scoped to the workspace, network off by default and git restricted to read-only, enforceable org-wide. Press Enter for the full definition. and three-layer egress. Each one is a hard control - it lives in the code or the org config around the agent, where an attacker who only controls text can't reach.

Learn more

Full explanation

Enterprise hooks outrank user hooks

Hooks deployed through enterprise MDM take precedence over hooks a user configures locally. Priority runs Enterprise → Team → Project → User, so an org hook outranks anything a developer sets locally. That ordering is the whole point for a security engineer: a developer can't disable or weaken the org's allowlist or audit hook by editing their own config, so the control survives a curious or compromised user. When you propose a hook-based control in an interview, say it's MDM-enforced - that's what makes it a hard control rather than a suggestion.

Learn more

Full explanation

beforeShellExecution

beforeShellExecution: chain a logger, then an allowlist that blocks anything off the approved set.ts

const ALLOWED = new Set(["npm test", "npm run build", "git status", "git diff"]);
const ESCALATE = new Set(["git push", "npm publish"]);

// Fired by Cursor before any shell command the agent proposes.
export function beforeShellExecution(cmd: string) {
  audit.log("shell.proposed", { cmd });          // logger runs first
  const command = cmd.trim();

  if (ALLOWED.has(command)) return { permission: "allow" };

  if (ESCALATE.has(command)) {
    // "ask" is the human gate: the person decides, not the model.
    return { permission: "ask", user_message: "Release command - approve only if you meant it." };
  }

  return {
    permission: "deny",
    user_message: "Command not on the allowlist. Open a PR or ask an admin.",
  };
}

Cursor enterprise controls, mapped to the threat model

Step 1 of 4

Enterprise hooks outrank user hooks

beforeShellExecution