Security & Compliance AI Agent Directives

Security work has too many alerts and too little evidence, and an AI agent is most useful when it is turning raw findings into ranked, defensible output. These security directives give an agent that job: triage CVEs against real deployment and reachability, translate a compliance requirement into a tested Rego/OPA policy, collect control-mapped evidence across cloud, IaC, and CI/CD for an audit, and analyze an SBOM for vulnerabilities, license risk, and staleness. Each directive is written for the agents teams already run, so cursor rules cve, opa, and sbom prompts paste straight into a rules file and run against the real scanners and APIs. The discipline enforced throughout is honesty: unknown exploitability is labeled unknown, evidence without an artifact is flagged as a gap, and nothing is fixed by wishful severity sorting. If you are collecting cursor rules security, supply chain, or ai agent devops directives, this category produces reports an AppSec or audit lead can trust rather than a list of everything that was ever flagged. Combine them in a rules file so the annual audit becomes a routine report with the evidence trail already attached. They make an annual review feel like a routine report, with the evidence trail that lets a lead answer a hard question fast and prove a control was actually checked when it matters.