Grok Bot for Teams and Enterprise

Grok Bot gives each person on your team standing Bots for everyday work: research, operations, documents, browsing, and automations. This page is for team and organization admins rolling Grok Bot out. Security reviewers should start with Grok Bot security and the Grok Bot security FAQ. Members who want the approval model should start there too.

Availability

That table is product access, not the admin control list. Grok Bot is included on Teams. Several settings are Enterprise only and do not appear for self-serve Teams. Admin controls marks each one.

Plans and billing is the canonical plan and usage matrix.

Enabling Grok Bot for your team

On the Teams plan, Grok Bot is enabled by default, and every member has access without any admin action. It stays off for teams on Privacy Mode (Legacy) or on a legacy request-based plan. There is no switch to turn it off.

On the Enterprise plan, an admin turns it on from Grok Bot in the Cursor dashboard. Once enabled, you can give access to all team members or limit it to specific groups with "Manage Group Access". Turning Grok Bot off blocks every member without deleting their computers.

Admins on either plan can bring members in with "Invite Team" on the Grok Bot page. Existing Cursor users on your team get an email with a download link. New users get an invitation to your Cursor team, by email or invite link, that also points them to Grok Bot. Teams that manage membership through SCIM see only the existing-users option.

Before you roll out

• Move off Privacy Mode (Legacy). That setting blocks Grok Bot entirely, and you're prompted to change it before enabling. Check the privacy setting in Team Settings.
• Plan for shared egress addresses. If your company restricts services by source IP, see static egress IPs.
• Clear your gateway. If member devices sit behind Zscaler or another TLS-inspecting proxy, allow Cursor's domains, including the nested *.*.cursorvm.com pattern, and exempt them from inspection before members connect. See Configure TLS-inspecting proxies.
• Decide how members sign in to company tools from the computer. See identity and sign-ins.
• Review the policies Grok Bot inherits: Team Rules and the connector policy on every plan, plus team Auto-review rules and the MCP allowlist on Enterprise.

Architecture

How Grok Bot is built

Grok Bot is a computer-use agent that operates applications, browsers, and development environments. It runs in Cursor's cloud, and each user's work executes on a dedicated cloud computer. The desktop and mobile apps are thin clients for chat, review, and approvals.

The security model rests on four principles:

• Per-user isolation. Each user's work runs in a dedicated Firecracker microVM, a micro virtual machine with hardware-level separation from other users.
• No access by default. A Bot can use only the accounts and plugins the user or team grants it.
• Human approval gates. Sensitive actions require user approval, evaluated by an independent review model called Auto Review.
• Administrative control. Team admins can set Team Rules, Cloud Agent delegation, template sharing, and the local execution ceiling. Network Controls, Team Setup, Allow Local Egress, Action Recording, Enforce Auto-review, Auto-review rules, and the organization-wide enable switch are Enterprise only.

The pieces fit together like this:

1. Local machine. Chat, review, and approvals happen on the member's device. Work runs in the hosted computer. Optional local execution requires per-command approval by default and can be turned off.
2. Environment. One persistent Firecracker microVM per user. Every Bot that user runs shares that computer. Admins manage Grok Bot from the Grok Bot page of the Cursor dashboard. Team Rules, Cloud Agent delegation, public template sharing, and Execution on Local Computer are available to team admins. Enterprise only on that page: the organization-wide enable switch, Network Controls, Team Setup, Allow Local Egress, Action Recording, Enforce Auto-review, Auto-review rules, and computer management for organization admins. Members never see this page.
3. The Bot. Shell, browser, and computer use inside the hosted computer. A Bot has no access by default and acts only with accounts the member signs it into. It hands login, two-factor authentication, and payment steps to the member.
4. Plugins. Your team's Cursor MCP (Model Context Protocol) policy applies in full, allowing or blocking each connector. OAuth tokens stay on Cursor's connector backend, and Bots invoke tools without receiving them.
5. Cloud Agents. Grok Bot can delegate coding tasks to separate computers under your existing Cloud Agent controls. Admins can disable spawning.
6. Models and data. Cursor manages model selection. With Privacy Mode enabled, customer data is not used for training; Cursor enforces this on its servers, and when the setting can't be verified, the system defaults to not training.

How users are isolated

Each user gets a dedicated computer with hardware-level separation, and one user cannot reach another user's computer. Every computer is a Firecracker microVM with its own kernel, memory, and virtual devices.

Within one user, the boundary is different: all of that user's Bots share one computer, and Bots isolate personalities and workspaces, not compute. Treat a login or file on the computer as available to every Bot that user runs, sign the browser out of accounts a Bot no longer needs, and remove sensitive temporary files when work completes. When a workload needs its own computer and credential set, give it its own Cursor user.

Admin controls

Most Grok Bot settings sit on the Grok Bot page of the Cursor dashboard, which only admins see. A few live in Team Settings, your Team Marketplace, or your identity provider. Several controls are available only on the Enterprise plan; the rest are available on Teams and Enterprise. Enterprise teams can also widen several of these controls for one cohort from a group's Grok Bot tab; see Group settings.

Access and identity

Who can use Grok Bot, and how members are provisioned.

Enable Grok Bot

The organization-wide switch on the Grok Bot page, with Manage Group Access beside it. Turning it on opens a setup modal that covers privacy mode, pricing, and model availability. Turning it off blocks every member without deleting their computers. See Enabling Grok Bot for your team.

Available on the Enterprise plan.

SCIM

SCIM 2.0 provisioning and deprovisioning through your identity provider. Members sign in to Grok Bot with their Cursor account, so your existing SCIM and SSO setup carries over. For Okta and Entra ID steps, including app assignment and sign-in rules for the computer browser, see Configure identity and access.

Available on the Enterprise plan.

Agent capabilities

What Bots may do on behalf of members. Each control applies to every member's Bots.

Cloud Agents

Allows or blocks Bots delegating coding tasks to Cursor Cloud Agents. The switch is on the Grok Bot page, applies to the whole team, and is on by default. Delegated work runs on separate computers under your existing Cloud Agent controls. Turn it off when your team doesn't need delegation.

Public template sharing

Controls whether members can publish Bot templates outside your team. Off keeps sharing team-only, and Cursor enforces the policy on its servers, including for templates that are already public. Enterprise teams start with public sharing off; other teams start with it allowed. For what a shared template contains, see Share a Bot.

Connector policy

Grok Bot inherits your team's Cursor connector policy. There is no separate Grok Bot connector list, and connectors appear as plugins in the app. Set which servers members can use from your Team Marketplace on the dashboard's Plugins & MCPs page, not on the Grok Bot page. The MCP allowlist is Enterprise only; see MCP server trust management. Any permitted connector is available to every Bot a member runs, and a blocked one shows as Disabled by team admin. Pushing connectors to members, whether mandatory or default-on, is not available.

Execution on Local Computer

Caps what Bots may do on a member's own machine through the desktop app: open files and run tasks. Pick Always allow, Ask every time, or Never allow on the Grok Bot page. Always allow, the default, leaves the choice to each member, whose own setting defaults to asking before every task. Ask every time makes every local task ask for approval, and Never allow turns local execution off for the whole team. A member's own setting still applies when it is stricter than the team's. Pick Never allow unless Bots have a specific reason to work on member machines. See local execution.

Allow Local Egress

Let members route Grok Bot's web traffic through their own computer. Off disables the option in Grok Bot. The switch is on by default. Turning it off stops active routes within five minutes. Turning it back on restores each member's previous choice. See Route traffic through your desktop.

Available on the Enterprise plan.

Rules and approvals

Guidance Bots follow, and the review layer that stops actions.

Team Rules

Rules that every member's Bots follow. Add them from the Grok Bot page and scope each rule to Cursor, Grok Bot, or both. Rules applied to Grok Bot are always required, so members can't turn them off. Keep them short and few, like "never move company data to personal accounts." Rules guide a Bot; for approval behavior, use Auto-review rules. For guidance that belongs to one cohort, add Group Rules under Group settings.

Enforce Auto-review

Prevents members from turning Auto-review off. The switch is on the Grok Bot page and is off by default. When it is on, Bots always check risky actions before running them and ask for approval when needed. Turn it on before you rely on team Auto-review rules. A group can lift the lock for its own members with Don't enforce for this group; see Group settings.

Available on the Enterprise plan.

Auto-review rules

Team-wide "Ask first" and "Allow automatically" rules that apply to every member's Bots on top of their own rules. Add them with "Configure Rules" on the Grok Bot page; changes save automatically. Members see the team rules under "Settings" > "General" > "Auto-review" but can't edit or delete them, and "Ask first" wins when rules conflict. Turning enforcement off stops applying the team rules. See approvals and Auto Review.

Available on the Enterprise plan.

Computers and network

How team computers are set up, what they can reach, and how you recreate or terminate them.

Network Controls

Restricts which destinations team computers can reach. Pick one of four modes, from allow-all to a team allowlist of domains and IP ranges. Directory groups can carry their own policy, and a lock makes the team policy apply to everyone. Teams without a policy default to allow-all. See network policy for the modes and how a new policy reaches running computers.

Available on the Enterprise plan.

Team Setup

Manifests of install scripts that run on every team computer, so the same tooling is present everywhere. Keep secret values out of setup scripts. Members see the managed setup under Team Setup in the app, where they can review or reinstall it. For how manifests run, and to install a networking client that reaches private services, see Connect to private networks. To run extra scripts on one cohort's computers only, add them under Group settings.

Available on the Enterprise plan.

Grok Bot Computers

Lets organization admins recreate or terminate the computers of many members at once, with a result for each member. Team admin rights aren't enough, because one computer spans every team the member belongs to. Recreate moves members to the latest image and Team Setup while keeping their Bots, files, and logins. Terminate ends the member's current work and keeps the durable disk; the member's next session starts a fresh computer on it. Neither action removes access: to do that, remove the member from the team or turn off Grok Bot for their group, and revoke their sessions in your identity provider. See Manage Grok Bot computers.

Available on the Enterprise plan.

Logging and audit

What gets recorded, and where it goes.

Action Recording

Records Bot actions: connector (MCP) tool calls, shell commands, browser navigations, and computer use sessions. Events are sanitized before they are stored or exported. Shell commands are secret-scrubbed; browser navigations keep each page as scheme://host/path with the title but strip query strings and credentials; computer use sessions record action and screenshot counts and the session duration, without the screenshots, clicks, or typed text. The switch is on the Grok Bot page and is off by default. Recorded events don't appear on the Audit Log page. To receive them in your own collector, configure OpenTelemetry Export, which delivers each event tagged cursor.surface=grok_bot. Retention details are on logging and audit.

Available on the Enterprise plan.

Audit logs

Admin, security, and authentication events, plus Grok Bot control-plane events: Bot creation, member access changes, Team Setup manifests, MCP authentication, Slack account links, and routines. Each row names the application that acted, so you can filter the log to Grok Bot. View them on the Audit Log page or stream them to your SIEM; see audit logs. For the actions Bots took, use Action Recording.

Available on the Enterprise plan.

OpenTelemetry Export

Streams Cursor usage metrics and logs, including recorded Grok Bot actions, to a collector you run. It's the customer path for Action Recording events. Configure it under Team Settings > OpenTelemetry Export. Endpoint requirements and the event schema are on OpenTelemetry Export.

Available on the Enterprise plan.

Group settings

The controls above set the team-wide baseline. To widen that baseline for one cohort, open a group your team owns from Members > Groups and use its Grok Bot tab. Group settings only widen: a group can grant its members more than the team allows, never less, and a member in several groups gets the most permissive result. This is the same rule as group model access. A group control left at the team's value changes nothing, so tighten controls on the Grok Bot page and widen them per group.

The tab has four sections:

• Agent Capabilities. Allow Cloud Agents, raise the Execution on Local Computer ceiling, or turn on Allow Local Egress for group members when the team has them off or stricter. For Auto-review, Don't enforce for this group lifts the team's Enforce Auto-review lock so group members can turn Auto-review off, and group Auto-review rules combine with the team's Auto-review rules, with "Ask first" winning when rules conflict.
• Network. The group's own network policy, as described under Network Controls. A locked team policy applies to everyone.
• Group Rules. Rules for the group's Bots, combined with Team Rules. Members can't turn them off.
• Setup Scripts. Manifests that run on group members' computers alongside Team Setup. They use the same structure and run the same way, and the same no-secrets rule applies. See how Team Setup runs your scripts.

Group settings apply to groups your team owns, whether you manage membership by hand or sync it through SCIM. They are separate from Organization Groups. To control who can use Grok Bot at all, use Manage Group Access on the Grok Bot page instead; see Enabling Grok Bot for your team.

Available on the Enterprise plan.

Admin API

Enable Grok Bot and manage capabilities, Enforce Auto-Review, group access, network policy, team rules, and setup scripts through the Admin API.

Security

The security model, network policy, approvals and Auto Review, identity, logging, data handling, and certifications live on Grok Bot security. Common review questions are on Grok Bot security FAQ.

Recommended configuration

For security-sensitive deployments, this is the recommended baseline.

For administrators:

1. Configure Network Controls. Enterprise only. Teams without a policy default to allow-all. Self-serve Teams cannot set this. See Grok Bot security.
2. Audit connector policy in Teams Marketplace before enabling Grok Bot. Any permitted connector is available to every Bot a member runs.
3. Turn on Enforce Auto-review before you rely on team rules. Enterprise only. Members can add stricter personal rules on top, and "Ask first" wins when rules conflict.
4. Set Execution on Local Computer to Never allow unless Bots need to act on member machines. The default leaves the choice to each member.
5. Disable Cloud Agent spawning if you don't need delegation.
6. Keep public template sharing off unless members should publish Bot templates outside the team.
7. Add team Auto-review rules. Enterprise only. Cover actions that should always ask first or can proceed automatically. Production deployments, external email, payments, and accepting legal terms are good "Ask first" examples. Keep automatic rules narrow.
8. Gate sign-in to managed devices through your identity provider. Grok Bot sign-in uses your SSO, so a device-aware sign-in policy applies to it. This gates sign-in, not the hosted computer itself.

For members:

1. Never paste credentials into chat. The masked secret request is the supported path.
2. Prefer Allow once over Always allow for actions that touch accounts, money, or shared resources.
3. Sign the Bot's browser into accounts sized to the task, and sign it out of accounts it no longer needs. Use scoped service accounts where the source system supports them.
4. Start new roles with read-only tasks and draft outputs, and keep sending, publishing, purchasing, deletion, and production changes behind approval.
5. Review installed plugins and active routines regularly, and pause a routine when its source system changes.

FAQ

Isolation, egress, approvals, logging, and data-handling questions are on Grok Bot security FAQ.

Related pages

• Grok Bot security
• Grok Bot security FAQ
• Configure identity and access
• Connect to private networks
• Configure TLS-inspecting proxies
• Manage Grok Bot computers
• Work with Grok Bot
• Admin API
• Grok Bot Conversation Insights
• Plans and billing
• Privacy and Data Governance