2 min lesson
The written artifact
Answer this: "How do you handle it in the recommendation?"
Step 1 of 2
The written artifact
Reviews that live only in a meeting evaporate. Produce a short recommendation document stakeholders can forward to their CISOChief Information Security Officer. The executive who owns security; usually the hardest and most important person to win over. Press Enter for the full definition. and CTO. The document mirrors the five steps; the risk register carries an owner and a mitigation per risk, and the phasing section says what ships now, what is deferred and why. Keep it short and defensible.
Do not present the ideal architecture as the only architecture. An org that cannot stand up PrivateLinkAn AWS connection Cursor uses for private Git provider and repository-origin traffic; it does not cover model-provider traffic. Press Enter for the full definition. to its self-hosted Git provider this quarter still needs a safe path. Balance the target against what they can actually run now and phase the rest.
An unadoptable recommendation is a failed review, however elegant.
“Your GitHub Enterprise Server is only reachable inside your network, so the target is private connectivity: AWS PrivateLinkAn AWS connection Cursor uses for private Git provider and repository-origin traffic; it does not cover model-provider traffic. Press Enter for the full definition. between Cursor and that Git provider, which also carries its webhooks back to Cursor, set up with Cursor's team. You've told me that is a quarter out, so this quarter we ship the safe interim: SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. and SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. against your IdP, Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. enforced org-wide, the model allowlist, and developer traffic over TLS through your existing proxy with Cursor's domains allowlisted. That covers the editor today; Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition. and BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition. against that server wait for the private leg. The PrivateLink gap goes in the risk register with your network lead as owner and a date at the end of next quarter. All of it is in the written recommendation I'll send this week, so your architects can circulate it.”
In the demo or scenario round, if asked to “walk us through how you'd run an architecture review,” lead with the structure (current state → constraints → integration → risk → target) and name the written artifact at the end. Ending on a circulatable document signals you understand the review exists to drive an internal decision.