Grok Bot for teams and enterprises

Grok Bot gives each person on your team standing Bots for everyday work: research, operations, documents, browsing, and automations. This page is for team and organization admins rolling Grok Bot out. Security reviewers should start with Grok Bot security and the Grok Bot security FAQ. Members who want the approval model should start there too.

That table is product access, not the admin control list. Grok Bot is included on Teams. Several settings are Enterprise only and do not appear for self-serve Teams. Admin controls marks each one.

Plans and billing is the canonical plan and usage matrix.

On the Teams plan, Grok Bot is enabled by default, and every member has access without any admin action. It stays off for teams on Privacy Mode (Legacy) or on a legacy request-based plan. There is no switch to turn it off.

On the Enterprise plan, an admin turns it on from Grok Bot in the Cursor dashboard. Once enabled, you can give access to all team members or limit it to specific groups with Manage Group Access. Turning Grok Bot off blocks every member without deleting their computers.

Admins on either plan can bring members in with Invite Team on the Grok Bot page. Existing Cursor users on your team get an email with a download link. New users get an invitation to your Cursor team, by email or invite link, that also points them to Grok Bot. Teams that manage membership through SCIM see only the existing-users option.

• Move off Privacy Mode (Legacy). That setting blocks Grok Bot entirely, and you are prompted to change it before enabling. Check the privacy setting in Team Settings.
• Plan for shared egress addresses. If your company restricts services by source IP, see static egress IPs.
• Clear your gateway. If member devices sit behind Zscaler or another TLS-inspecting proxy, allow Cursor's domains, including the nested *.*.cursorvm.com pattern, and exempt them from inspection before members connect. See Configure TLS-inspecting proxies.
• Decide how members sign in to company tools from the computer. See identity and sign-ins.
• Review the policies Grok Bot inherits: Team Rules and the connector policy on every plan, plus team Auto-review rules and the MCP allowlist on Enterprise.

Grok Bot is a computer-use agent that operates applications, browsers, and development environments. It runs in Cursor's cloud, and each user's work executes on a dedicated cloud computer. The desktop and mobile apps are thin clients for chat, review, and approvals.

The security model rests on four principles:

• Per-user isolation. Each user's work runs in a dedicated Firecracker microVM, a micro virtual machine with hardware-level separation from other users.
• No access by default. A Bot can use only the accounts and plugins the user or team grants it.
• Human approval gates. Sensitive actions require user approval, evaluated by an independent review model called Auto Review.
• Administrative control. Team admins can set Team Rules, Cloud Agent delegation, template sharing, and the local execution ceiling. Network Controls, Team Setup, Allow Local Egress, Action Recording, Enforce Auto-review, Auto-review rules, and the organization-wide enable switch are Enterprise only.

The pieces fit together like this:

1. Local machine. Chat, review, and approvals happen on the member's device. Work runs in the hosted computer. Optional local execution requires per-command approval by default and can be turned off.
2. Environment. One persistent Firecracker microVM per user. Every Bot that user runs shares that computer. Admins manage Grok Bot from the Grok Bot page of the Cursor dashboard. Team Rules, Cloud Agent delegation, public template sharing, and Execution on Local Computer are available to team admins. Enterprise only on that page: the organization-wide enable switch, Network Controls, Team Setup, Allow Local Egress, Action Recording, Enforce Auto-review, Auto-review rules, and computer management for organization admins. Members never see this page.
3. The Bot. Shell, browser, and computer use inside the hosted computer. A Bot has no access by default and acts only with accounts the member signs it into. It hands login, two-factor authentication, and payment steps to the member.
4. Plugins. Your team's Cursor MCP (Model Context Protocol) policy applies in full, allowing or blocking each connector. OAuth tokens stay on Cursor's connector backend, and Bots invoke tools without receiving them.
5. Cloud Agents. Grok Bot can delegate coding tasks to separate computers under your existing Cloud Agent controls. Admins can disable spawning.
6. Models and data. Cursor manages model selection. With Privacy Mode enabled, customer data is not used for training; Cursor enforces this on its servers, and when the setting cannot be verified, the system defaults to not training.

Each user gets a dedicated computer with hardware-level separation, and one user cannot reach another user's computer. Every computer is a Firecracker microVM with its own kernel, memory, and virtual devices.

Within one user, the boundary is different: all of that user's Bots share one computer, and Bots isolate personalities and workspaces, not compute. Treat a login or file on the computer as available to every Bot that user runs, sign the browser out of accounts a Bot no longer needs, and remove sensitive temporary files when work completes. When a workload needs its own computer and credential set, give it its own Cursor user.

Most Grok Bot settings sit on the Grok Bot page of the Cursor dashboard, which only admins see. A few live in Team Settings, your Team Marketplace, or your identity provider. Several controls are available only on the Enterprise plan; the rest are available on Teams and Enterprise.

Who can use Grok Bot, and how members are provisioned.

The organization-wide switch on the Grok Bot page, labeled Enable Grok Bot for your team, with Manage Group Access beside it. A team that has never set up Grok Bot sees a Set Up Grok Bot call to action with an Open Docs link instead; on Enterprise it opens a setup modal that covers privacy mode, pricing, and model availability. Turning the switch off opens a Disable Grok Bot confirmation and then blocks every member without deleting their computers. On the Teams plan the same card is a status line, Grok Bot is enabled for your team, with no switch. See Enabling Grok Bot for your team.

Available on the Enterprise plan.

SCIM 2.0 provisioning and deprovisioning through your identity provider. Members sign in to Grok Bot with their Cursor account, so your existing SCIM and SSO setup carries over. For Okta and Entra ID steps, including app assignment and sign-in rules for the computer browser, see Configure identity and access.

Available on the Enterprise plan.

What Bots may do on behalf of members. Each control applies to every member's Bots.

Allows or blocks Bots delegating coding tasks to Cursor Cloud Agents. The switch is on the Grok Bot page, applies to the whole team, and is on by default. Delegated work runs on separate computers under your existing Cloud Agent controls. Turn it off when your team does not need delegation.

Controls whether members can publish Bot templates outside your team. Off keeps sharing team-only, and Cursor enforces the policy on its servers, including for templates that are already public. Enterprise teams start with public sharing off; other teams start with it allowed. For what a shared template contains, see Share a Bot.

Grok Bot inherits your team's Cursor connector policy. There is no separate Grok Bot connector list, and connectors appear as plugins in the app. Set which servers members can use from your Team Marketplace on the dashboard's Plugins page, not on the Grok Bot page. The MCP allowlist is Enterprise only; see MCP server trust management. Any permitted connector is available to every Bot a member runs, and a blocked one shows as Disabled by team admin. Pushing connectors to members, whether mandatory or default-on, is not available.

Caps what Bots may do on a member's own machine through the desktop app: open files and run tasks. Pick Always allow, Ask every time, or Never allow on the Grok Bot page. Always allow, the default, leaves the choice to each member, whose own setting defaults to asking before every task. Ask every time makes every local task ask for approval, and Never allow turns local execution off for the whole team. A member's own setting still applies when it is stricter than the team's. Pick Never allow unless Bots have a specific reason to work on member machines. See local execution.

Let members route Grok Bot's web traffic through their own computer. Off disables the option in Grok Bot. The switch is on by default. Turning it off stops active routes within five minutes. Turning it back on restores each member's previous choice. See Route traffic through your desktop.

Available on the Enterprise plan.

Guidance Bots follow, and the review layer that stops actions.

Rules that every member's Bots follow. Add them from the Grok Bot page and scope each rule to Cursor, Grok Bot, or both. Rules applied to Grok Bot are always required, so members cannot turn them off. Keep them short and few, like "never move company data to personal accounts." Rules guide a Bot; for approval behavior, use Auto-review rules.

Prevents members from turning Auto-review off. The switch is on the Grok Bot page and is off by default. When it is on, Bots always check risky actions before running them and ask for approval when needed. Turn it on before you rely on team Auto-review rules.

Available on the Enterprise plan.

Team-wide Ask first and Allow automatically rules that apply to every member's Bots on top of their own rules. Add them with Configure Rules on the Grok Bot page; changes save automatically. Members see the team rules under Settings → General → Auto-review but cannot edit or delete them, and Ask first wins when rules conflict. Turning enforcement off stops applying the team rules. See approvals and Auto Review.

Available on the Enterprise plan.

How team computers are set up, what they can reach, and how you recreate or terminate them.

Restricts which destinations team computers can reach. On the dashboard the section is Network and the control is Grok Bot Network Access. Pick one of four modes, from allow-all to a team allowlist of domains and IP ranges: No Policy (Allow All), Allow All Network Access, Defaults + Team Allowlist, or Team Allowlist Only. Directory groups can carry their own policy as Group Network Access, and Lock for all groups makes the team policy apply to everyone. Teams without a policy default to allow-all. See network policy for the modes and how a new policy reaches running computers.

Available on the Enterprise plan.

Manifests of install scripts that run on every team computer, so the same tooling is present everywhere. Keep secret values out of setup scripts. Members do not see or manage the setup in the app; scripts run on their computer when it starts and on a periodic refresh. For how manifests run, and to install a networking client that reaches private services, see Connect to private networks.

Available on the Enterprise plan.

Lets organization admins recreate or terminate the computers of many members at once, with a result for each member. Team admin rights are not enough, because one computer spans every team the member belongs to. Recreate moves members to the latest image and Team Setup while keeping their Bots, files, and logins. Terminate ends the member's current work and keeps the durable disk; the member's next session starts a fresh computer on it. Neither action removes access: to do that, remove the member from the team or turn off Grok Bot for their group, and revoke their sessions in your identity provider. See Manage Grok Bot computers.

Available on the Enterprise plan.

What gets recorded, and where it goes.

Records Bot actions: connector (MCP) tool calls, shell commands, browser navigations, and computer use sessions. Events are sanitized before they are stored or exported. Shell commands are secret-scrubbed; browser navigations keep each page as scheme://host/path with the title but strip query strings and credentials; computer use sessions record action and screenshot counts and the session duration, without the screenshots, clicks, or typed text. The switch is on the Grok Bot page and is off by default. Recorded events do not appear on the Audit Log page. To receive them in your own collector, configure OpenTelemetry Export, which delivers each event tagged cursor.surface=grok_bot. Retention details are on logging and audit.

Available on the Enterprise plan.

Admin, security, and authentication events, plus Grok Bot control-plane events: Bot creation, member access changes, Team Setup manifests, MCP authentication, Slack account links, and routines. Each row names the application that acted, so you can filter the log to Grok Bot. View them on the Audit Log page or stream them to your SIEM; see audit logs. For the actions Bots took, use Action Recording.

Available on the Enterprise plan.

Streams Cursor usage metrics and logs, including recorded Grok Bot actions, to a collector you run. It is the customer path for Action Recording events. Configure it under Team Settings → OpenTelemetry Export. Endpoint requirements and the event schema are on OpenTelemetry Export.

Available on the Enterprise plan.

Enable Grok Bot and manage capabilities, Enforce Auto-review, group access, network policy, team rules, and setup scripts through the Admin API.

The security model, network policy, approvals and Auto Review, identity, logging, data handling, and certifications live on Grok Bot security. Common review questions are on the Grok Bot security FAQ.

For security-sensitive deployments, this is the recommended baseline.

For administrators:

1. Configure Network Controls. Enterprise only. Teams without a policy default to allow-all. Self-serve Teams cannot set this. See network policy.
2. Audit connector policy in Teams Marketplace before enabling Grok Bot. Any permitted connector is available to every Bot a member runs.
3. Turn on Enforce Auto-review before you rely on team rules. Enterprise only. Members can add stricter personal rules on top, and Ask first wins when rules conflict.
4. Set Execution on Local Computer to Never allow unless Bots need to act on member machines. The default leaves the choice to each member.
5. Disable Cloud Agent spawning if you do not need delegation.
6. Keep public template sharing off unless members should publish Bot templates outside the team.
7. Add team Auto-review rules. Enterprise only. Cover actions that should always ask first or can proceed automatically. Production deployments, external email, payments, and accepting legal terms are good Ask first examples. Keep automatic rules narrow.
8. Gate sign-in to managed devices through your identity provider. Grok Bot sign-in uses your SSO, so a device-aware sign-in policy applies to it. This gates sign-in, not the hosted computer itself.

For members:

1. Never paste credentials into chat. The masked secret request is the supported path.
2. Prefer Allow once over Always allow for actions that touch accounts, money, or shared resources.
3. Sign the Bot's browser into accounts sized to the task, and sign it out of accounts it no longer needs. Use scoped service accounts where the source system supports them.
4. Start new roles with read-only tasks and draft outputs, and keep sending, publishing, purchasing, deletion, and production changes behind approval.
5. Review installed plugins and active routines regularly, and pause a routine when its source system changes.

The organization-wide Enable Grok Bot switch is Enterprise only. It lives on the Grok Bot page of the Cursor dashboard. Self-serve Teams do not get this switch. Disabling blocks members without deleting their computers.

Yes. Use the Admin API.

A separate Grok Bot spend cap is not available today. Account-level on-demand controls apply, and the per-product split is on the dashboard usage page.

Your team's connector policy blocks that server. Enable it in Teams Marketplace, add its server URL to your MCP allowlist if you use one, and have the member restart the app. If a permitted plugin still fails for regular members with a vendor-side permission error, check the provider's requirements; some vendors restrict their MCP endpoints to their own administrators. See Connect an app.

Members can send a request from the app. On a pooled Enterprise team whose admin has not finished setup, members see a team-setup message instead. The next step is for an admin to use the Enterprise only enable switch. Self-serve Teams do not use that switch.

Yes, on Enterprise teams where it has rolled out. The Conversation Insights page of the Analytics dashboard has a Grok Bot source that groups Bot conversations by Type of Work and Level of Automation. See Grok Bot Conversation Insights.

Isolation, egress, approvals, logging, and data-handling questions are on the Grok Bot security FAQ.

• Grok Bot security
• Grok Bot security FAQ
• Configure identity and access
• Connect to private networks
• Configure TLS-inspecting proxies
• Manage Grok Bot computers
• Approvals, security, and privacy
• Admin API
• Grok Bot Conversation Insights
• Plans and billing
• Privacy and Data Governance

Contact your Cursor account team about Enterprise plan enablement, egress ranges, residency commitments, and security review support.