AI coding agents and verification layers: what are teams missing?

TL;DR: Cursor’s internal workflow shows that AI-written code is no longer limited by generation speed, but by verification architecture, risk routing, and evidence quality, according to Arize’s coverage of its Arize Observe 2026 session. That shifts governance from reviewing every diff to deciding which agent-produced artefacts are trustworthy enough for auto-merge and where human review still matters.

NHIMG editorial — based on content published by Arize: Inside Cursor’s agent factory and how it verifies AI-written code

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes

Questions worth separating out

Q: How should security teams govern AI agents that can read tickets and open pull requests?

A: Treat the agent as a governed non-human identity with separate permissions for reading, analysing, and writing.

Q: Why do AI-assisted development workflows need evidence-based approval instead of human review alone?

A: Because diffs show intent, not behavior.

Q: What do organisations get wrong about agent evaluation?

A: They often score the final response and assume that means the workflow was safe.

Practitioner guidance

• Define evidence-based merge gates Require each AI-generated change to ship with a minimum evidence set, such as CI results, security checks, and an exercised artifact that proves behaviour.
• Route review by change risk Classify pull requests by blast radius, data sensitivity, and operational impact so high-risk changes go to the right human reviewer before merge.
• Treat agent permissions as delegated identities Scope the agent’s tool access, repo access, and execution rights as if they were a non-human identity with explicit lifecycle and revocation rules.

What's in the full article

Arize’s full article covers the operational detail this post intentionally leaves for the source:

• How Cursor structures evidence collection across CI, security review, demos, and human routing
• The way Bugbot turns review comments into rules and evaluation cases for future pull requests
• Examples of how Cursor uses specialized agents for diagnosis, self-driving PRs, and workflow optimisation
• The practical shape of the skill library and how it is pruned to keep context sharper

👉 Read Arize’s analysis of how Cursor verifies AI-written code →

AI coding agents and verification layers: what are teams missing?

Explore further

View Full Forum →  |  NHI Foundation Course →