Diesen Guide auf Deutsch lesen
How do you roll out AI coding agents like Cursor and Claude Code to an engineering team?
Short answer: Run a 4–6 week pilot with one team and one or two repositories. Write a shared rules file (AGENTS.md, CLAUDE.md or Cursor rules), set agent permissions in version-controlled settings, keep every agent change behind pull-request review and CI security checks, and compare delivery metrics against a baseline before you scale. BSI, ANSSI and ENISA all stress review.
Last reviewed: 2026-10-31.
Coding agents change two things at once: how fast code is written, and how much code your reviewers and security checks have to absorb. The German and French cybersecurity agencies put it plainly: productivity gains in development "must be compensated by appropriate scaling measures in quality assurance teams" (BSI/ANSSI, AI Coding Assistants). The same report recommends an evaluation phase that monitors key figures before wider use. Google's DORA research describes AI as an amplifier of an organisation's existing strengths and weaknesses (DORA 2025). A pilot shows you which of those you're amplifying.
- Pilot scope. One team, one or two repositories, real work from the backlog. Not a demo project.
- Company accounts, not private ones. BSI/ANSSI recommend prohibiting uncontrolled access through employees' private accounts and preferring securely configured company accounts.
- Data-use terms. Check whether the provider uses your code or prompts for training, and which data the agent may see.
- People. Inform the people affected early. BSI/ANSSI explicitly name the works council (Betriebsrat) among the committees to involve.
- Baseline. Record the metrics below for the last 4–8 weeks, so you can compare.
| Week | Focus | What you set up | Done when |
|---|---|---|---|
| 0 | Prepare | Pilot team and repos, company accounts, data-use check, baseline metrics | Everyone has access; baseline recorded |
| 1 | Rules files and kickoff | A shared AGENTS.md (or CLAUDE.md / .cursor/rules) with build and test commands, conventions, architecture limits and security rules. Kickoff workshop for the pilot team. | Agents produce code that follows your conventions without being reminded |
| 2 | Permissions | Version-controlled allow / ask / deny rules; deny access to secrets and .env files; no production credentials in the agent's environment; bypass modes disabled; organisation-wide managed settings where available | A new developer gets the same agent limits by cloning the repo |
| 3 | Pull-request review | Protected main branch, required reviews, code owners for sensitive paths, small PRs, an "AI-assisted" label, and a PR template that states what the agent did and what a human verified | No agent change reaches main without a human approval |
| 4 | CI and security checks | Required status checks: tests, static analysis (SAST), dependency and secret scanning, and an allow-list or review step for new packages | A failing check blocks the merge, whoever wrote the code |
| 5 | Widen the use cases | Tests, refactoring, documentation, bug triage; a second, advanced session (test-driven work with agents, sub-agents, MCP servers with reviewed access) | The team picks agents by default for suitable tasks |
| 6 | Measure and decide | Compare against the baseline, collect developer feedback, write a one-page team policy | Go, adjust, or stop, decided on evidence |
Short on time? A 4-week version combines weeks 2 and 3, and weeks 4 and 5. Don't drop the baseline or the measurement week.
- How to build, test and lint the project, as exact commands.
- Code style and naming, with one short example.
- Architecture limits: which layers may call which, and which folders are off-limits.
- Security rules: no secrets in code, approved crypto and auth libraries, input validation, and "ask before adding a dependency". The OpenSSF guide to AI code assistant instructions is a good starting list.
- Definition of done: tests written and passing, docs updated.
AGENTS.md is an open format, "a README for agents", used by more than 60,000 open-source projects. Claude Code reads CLAUDE.md files. Cursor uses project rules in .cursor/rules and also supports AGENTS.md. Keep one source of truth and point the others at it.
One important limit: rules files guide the agent; they don't enforce anything. Claude Code's documentation says it directly: instructions in CLAUDE.md shape what Claude tries to do, but they don't change what Claude Code allows (permissions docs). Enforcement lives in permissions, review and CI.
Claude Code evaluates permission rules in a fixed order (deny, then ask, then allow), and the rules can be checked into version control. Organisations can push managed settings that individual developers can't override, and can disable the bypass-permissions mode. Cursor and other tools have their own equivalents. The principle is the same everywhere: start narrow, and widen on evidence.
Use your Git platform's protected branches to require pull-request reviews, code-owner approval and passing status checks before merging. ENISA's draft advisory states that AI-generated code should face the same security requirements and assurance activities as developer-written code, including code review, testing, SAST, DAST and dependency scanning (ENISA Technical Advisory on AI-assisted software development, draft v0.4, September 2026).
| Risk | What can go wrong | Control | Source |
|---|---|---|---|
| Prompt injection | Text in an issue, a README, a web page or a dependency instructs the agent to do something else | Treat external content as data, limit tools, require human approval for risky actions | OWASP LLM01:2025; OWASP Agentic Top 10 (ASI01 Agent Goal Hijack) |
| Excessive agency | The agent has more functions, permissions or autonomy than the task needs | Narrow allow / ask / deny rules, no production credentials, bypass modes off | OWASP LLM06:2025 |
| Tool misuse and privilege abuse | Legitimate tools used destructively; leaked credentials let the agent act beyond its scope | Least-privilege tokens, sandboxed environments, logged tool calls | OWASP Agentic Top 10 (ASI02, ASI03) |
| Hallucinated or malicious packages | The agent suggests a package that doesn't exist, and an attacker registers that name ("slopsquatting") | Approved registries, an allow-list or review for new dependencies, dependency scanning, SBOM | BSI/ANSSI; ENISA package manager advisory |
| Functional but insecure code | Code works but lacks security controls | Security rules in the rules file, SAST, required review | ENISA AI advisory (draft) |
| Data leakage | Secrets, infrastructure details or customer data end up in prompts or provider logs | Company accounts, data-use terms checked, secrets denied to the agent | BSI/ANSSI |
| Automation bias | Convincing code and explanations get approved without understanding | Reviewers must understand and be able to reproduce changes; small PRs | BSI/ANSSI |
| Unsupported security claims | "All checks passed" or "this is secure" is accepted without evidence | CI evidence linked in the PR, not the agent's summary | ENISA AI advisory (draft) |
| Insufficient review capacity | Reviewers can't keep up with the volume of AI-generated changes | Track review load; scale AppSec and review time with output | ENISA AI advisory (draft); BSI/ANSSI |
| Poisoned rules, skills or MCP servers | A tampered instruction file or tool changes agent behaviour | Treat rules, skills and MCP servers as code: review, pin, source from trusted places | ENISA AI advisory (draft); OWASP Agentic Top 10 (ASI04) |
| Area | Metric | Why |
|---|---|---|
| Delivery | Change lead time, deployment frequency | Is work reaching production faster? (DORA metrics) |
| Stability | Change fail rate, failed deployment recovery time, deployment rework rate | Is speed costing quality? |
| Review load | PR size, time to first review, review hours per week | BSI/ANSSI suggest watching security-team workload |
| Security | SAST and dependency findings per PR, secrets caught, new dependencies added | Catches the risks in the table above |
| Cost | Seats plus usage per developer per month | Keeps the business case honest |
| Adoption and experience | Share of PRs that are agent-assisted, short developer survey | Shows whether people actually use it |
Compare week 6 with the baseline. Don't compare one team against another.
| In-house | Agency or external trainer | |
|---|---|---|
| Works best when | A senior engineer already uses agents daily and has time to own the rollout | Nobody has the hours, or past attempts stalled |
| Strengths | Deep context on your codebase; no external cost | A tested setup, faster start, an outside view on security and review |
| Risks | Rollout competes with delivery work; habits stay individual | Knowledge leaves with the trainer unless it's recorded and written down |
| Good combination | Internal owners run the pilot and the policy | A kickoff and an advanced workshop, recorded for new hires |
Made By Agents runs coding-agent workshops for engineering teams: Cursor, Claude Code, repo agents, review loops, and the guardrails that keep output production-grade. Sessions are booked by the hour at a fixed fee, quoted after a free Discovery Call. Team workshops are booked as a half or full day, in English or German, mostly remote, with on-site available on request. Workshops can start from zero and use your stack.
One published (anonymised) reference describes a remote workshop series covering setup, fundamentals, context and rules, prompt and model management, memory, MCP servers, sub-agents and advanced workflows, including AI-assisted TDD, review, security and refactoring. Sessions were recorded so new hires could catch up (references). Every session is with Tobias Wupperfeld directly. He builds AI systems daily, has more than 5 years of AI development experience, and is Head of AI at JAN3.
For hands-on tips, see 3 documentation tricks for Cursor, AI pair programming best practices (TDD and the Memory Bank pattern) and how to secure vibe-coded apps.
How long does it take to roll out AI coding agents to a team?
Plan a 4–6 week pilot with one team and one or two repositories, then decide whether to scale based on metrics you baselined before week 1.
Which tool should we use: Cursor, Claude Code or Codex?
The rollout steps are the same for all of them. Pick the one that fits your developers and stack, and buy company accounts rather than letting people use private ones.
What is an AGENTS.md or CLAUDE.md file?
A file in the repository that tells coding agents how your project works: commands, conventions, limits and security rules. AGENTS.md is an open format used by more than 60,000 open-source projects.
Is it safe to let coding agents run commands?
Within limits: explicit allow, ask and deny rules, no secrets or production credentials, and every change behind review and CI. OWASP lists excessive agency as a top risk.
What do the security agencies recommend?
BSI and ANSSI say AI coding assistants are no substitute for experienced developers, call for a risk analysis first, and say generated code should be checked and reproduced by developers. ENISA's draft advisory says AI-generated code must face the same checks as human-written code.
How do we measure whether it worked?
Compare DORA delivery metrics, review load, security findings, new dependencies and cost per developer against a baseline taken before week 1.
Should we do this in-house or with outside help?
In-house works if a senior engineer has time to own it. Many teams combine both: a workshop to start, internal owners to run it.
Planning a rollout? Book a free 20-minute Discovery Call and we'll match the format: a half- or full-day coding-agent workshop, a stack review, or a company-wide Deep AI Audit.
See consulting sessions and workshops →
Last reviewed: 2026-10-31 by Tobias Wupperfeld.