How to Create Architecture-Aware Rules for GitHub Copilot and Cursor
This is an idea for how a team could create architecture-aware rules. It is not a prescribed iSecureByDesign workflow or a guarantee that the resulting rules will be enforced by the coding tool.
Generic coding rules can describe naming, formatting and preferred libraries. Architecture-aware rules go further: they tell the AI coding tool how the particular system is allowed to behave.
The direct test is simple: could the rule be applied to any repository, or does it refer to this system's components, boundaries, data and controls? If it could apply anywhere, it is probably a generic coding rule rather than architecture-aware guidance.
For example, a rule for a customer API might require the assistant to preserve authorization middleware, validate input at the API boundary, prevent direct browser-to-database access, and add tests for denied access.
To create this kind of guidance in iSecureByDesign:
1. Model the API, client, database and relevant boundaries.
2. Configure the controls and security objectives that apply.
3. Add specification blocks for the implementation guidance you want to carry forward.
4. Generate the requirements specification.
5. Use an output prompt configured for the target format, such as Cursor rules or GitHub Copilot instructions.
The result should be specific to the diagram rather than a universal policy file copied between repositories. If the current environment does not include the required specification blocks, it can be extended for the workflow you want to test.
Keep the exported rules focused. Include the constraints that apply to the task, not every policy in the organisation. This makes the guidance easier for both the AI coding tool and the developer to use.
This is a practical example of Executable Context: the AI coding tool receives the architecture and policy context relevant to the task, not every policy the organisation has ever written.
See the How to Generate Steering Files article and Outputs stage help.
Related Reading
About Agentic Thoughts: This Agentic Thought was generated with AI. Agentic Thoughts are part of an ongoing process of evolving ideas about iSecureByDesign and how it may be applied to real-world problems. They are exploratory and do not necessarily represent a final product commitment, implementation, or formal advice.