2 min lesson
Governing agents at scale
Put yourself in this case: "A platform lead at a 40,000-engineer org asks: 'If agents can run commands and call tools, how do we keep that governable at our scale?' How do you frame the answer?" Give the clearest next step.
Step 1 of 3
The privacy foundation answers where code goes. The next question a platform team asks is sharper: now that an agent can run commands and reach tools on its own, what stops it from doing the wrong thing?
Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. by default, ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition. with every provider, SOC 2 Type II and SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition./SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition./MDM are the secure foundation you already sold. Agent governance is the layer on top. As an agent gets more agency - running terminal commands, editing files, calling tools - the security surface grows with it. Three controls put deterministic boundaries around that agency, and each is enforceable org-wide so an individual cannot quietly disable it.
Learn more
Full explanation
The capability-control stack
Interactive diagram. Tab through its regions; each focused region shows its detail in the panel below.
Four containment layers, each assuming the one above can fail: model/MCP allowlist, hooks, terminal sandbox and - for cloud agents - VM isolation as the strongest boundary. All rest on the privacy foundation and are enforced org-wide.