1 min lesson
Mapping Cursor into their topology
Compare two rows from "Mapping Cursor into their topology", then say when each one fits.
Step 1 of 2
Mapping Cursor into their topology
The heart of the review is placing Cursor into four existing planes the customer already runs. Do it as a table they can paste into their own doc.
- Their plane
- SDLC
- Where Cursor slots in
- Author step upstream of PR review and CI; agent produces scoped diffs
- What you must confirm
- Branch protection and review gates stay mandatory
- Their plane
- Identity
- Where Cursor slots in
- SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. (SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition./OIDCOpenID Connect. The modern single sign-on standard, built as an identity layer on top of OAuth 2.0. Where SAML is XML and enterprise-legacy, OIDC is JSON and what newer tools implement first. Press Enter for the full definition.) + SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. against their IdP; RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition. for admin
- What you must confirm
- Which IdP; SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. group-to-team mapping
- Their plane
- Network
- Where Cursor slots in
- Private connectivity via PrivateLinkAn AWS connection Cursor uses for private Git provider and repository-origin traffic; it does not cover model-provider traffic. Press Enter for the full definition. / Cloudflare Tunnel; IP allowlist
- What you must confirm
- Egress policy; can traffic stay off public internet
- Their plane
- CI/CDContinuous Integration / Continuous Delivery. The automated pipeline that builds, tests and ships code so changes reach production safely and often. Press Enter for the full definition.
- Where Cursor slots in
- Unchanged - same SASTStatic Application Security Testing. Scanning source code for vulnerabilities without running it. In AI-heavy workflows it is the automated gate that reads every generated diff before a human does. Press Enter for the full definition./DASTDynamic Application Security Testing. Probing a running application for vulnerabilities from the outside, the way an attacker would. Complements SAST, which reads the code instead of poking the app. Press Enter for the full definition./SCASoftware Composition Analysis. Scanning third-party dependencies for known vulnerabilities and license problems. Press Enter for the full definition./secrets gates run on the diff
- What you must confirm
- Existing gates remain; nothing weakened
| Their plane | Where Cursor slots in | What you must confirm |
|---|---|---|
| SDLC | Author step upstream of PR review and CI; agent produces scoped diffs | Branch protection and review gates stay mandatory |
| Identity | SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. (SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition./OIDCOpenID Connect. The modern single sign-on standard, built as an identity layer on top of OAuth 2.0. Where SAML is XML and enterprise-legacy, OIDC is JSON and what newer tools implement first. Press Enter for the full definition.) + SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. against their IdP; RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition. for admin | Which IdP; SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. group-to-team mapping |
| Network | Private connectivity via PrivateLinkAn AWS connection Cursor uses for private Git provider and repository-origin traffic; it does not cover model-provider traffic. Press Enter for the full definition. / Cloudflare Tunnel; IP allowlist | Egress policy; can traffic stay off public internet |
| CI/CDContinuous Integration / Continuous Delivery. The automated pipeline that builds, tests and ships code so changes reach production safely and often. Press Enter for the full definition. | Unchanged - same SASTStatic Application Security Testing. Scanning source code for vulnerabilities without running it. In AI-heavy workflows it is the automated gate that reads every generated diff before a human does. Press Enter for the full definition./DASTDynamic Application Security Testing. Probing a running application for vulnerabilities from the outside, the way an attacker would. Complements SAST, which reads the code instead of poking the app. Press Enter for the full definition./SCASoftware Composition Analysis. Scanning third-party dependencies for known vulnerabilities and license problems. Press Enter for the full definition./secrets gates run on the diff | Existing gates remain; nothing weakened |
Surface risk before security does
The fastest way to lose an architecture review is to let the security architect find a risk you skipped. The fastest way to win one is to raise it yourself, with the mitigation already attached.
Volunteering the BYO-keys ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition. boundary or the fact that autonomous merge would break separation of dutiesNo single person can author, approve and deploy the same change. The core control AI autonomy has to respect. Press Enter for the full definition. reads as senior judgment - not weakness.