Skip to lesson
Exit
Security, Governance & Architecture1 / 2

1 min lesson

Rules and standards as the upstream constraint

Give the practical answer to "What is the cheapest place to enforce an org's security conventions on AI-authored code and why?" Then name the detail that supports it.

Step 1 of 2

Rules and standards as the upstream constraint

Catching every problem in review is expensive. The cheaper lever is constraining output before it is written. Cursor Rules (.cursor/rules) encode the org's conventions, banned patterns and security practices so generated code starts aligned with the house standard.

.cursor/rules - encode org standards so AI output starts compliant
# Security & convention rules applied to AI-authored code
- Never log secrets, tokens or PII; use the redaction helper in lib/log.
- All DB access goes through the repository layer; no raw SQL in handlers.
- Validate and parameterize every external input; no string-built queries.
- New endpoints require an authz check and a test before they merge.

Rules do not replace review. They raise the floor, so the diff a reviewer sees already follows conventions and the review focuses on intent and edge cases instead of style nits.