A worked answer sounds like

“First, clarify. What's their security posture today? Are they already running an AI tool? Is it a monorepo or many repos? Who owns dev tooling? Then frame the path: pilot with one team, expand to a few once adoption metrics look healthy, then go org-wide. Name the controls that let security sign off before scale, not after - Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. and ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition., SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition./SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition. and SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition., role-based access, model and MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. allowlists, and audit logs. Tie it to outcomes they measure, like PR cycle time, review load and onboarding ramp against a baseline. And I'd call the risks up front, skeptical senior engineers and security sign-off, with how I'd de-risk each before it stalls the rollout.”

When a scenario is underspecified, say so and ask one sharp clarifying question before you dive in. “Before I scope this - is their main blocker security sign-off or skeptical engineers? The rollout looks different.” That single move signals discovery instinct, which is the core of the job.