2 min lesson

Layer the controls across the lifecycle

Walk through "Layer the controls across the lifecycle" in order, then name the proof that tells you it worked.

Layer the controls across the lifecyclein-flight validation, then PR-time, then manual

The PR-time pipeline above is the last gate, not the only one. A practitioner who builds this kind of review describes a layered architecture where each control sits at a different point in the dev lifecycle, so a bug has to get past several checks to ship.

LAYERED DEFENSE: WHERE EACH CONTROL FIRES

1/3

Hooks + rules · gate: Cursor hooks plus Cursor rules run validation as the agent is actually performing actions - hooks are called out as quite powerful here, because they let you check work in-flight rather than after the fact. This is the earliest and cheapest place to catch a bad pattern.

diagram: flow

Hooks + rules validate while the agent works; manual bug-hunting runs in between; Bugbot is the last step at PR time. Each layer catches what the previous one missed.

Layer the controls across the lifecycle

Step 1 of 2

Layer the controls across the lifecyclein-flight validation, then PR-time, then manual