Grok Bot for Teams and Enterprise: Rollout and Admin Controls

Individuals get Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. with every paid Cursor plan, and on Teams every member has access without any admin action. Enterprise works differently: an admin has to turn it on from the Grok Bot page of the Cursor dashboard before anyone can use it.

On Enterprise, turning the switch on opens a setup modal that covers privacy mode, billing and model availability, offers to turn on Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition. when they are off, and asks you to accept the Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. Terms. After that, Manage Group Access limits it to specific groups, or you leave it open to all members. Turning Grok Bot off blocks every member without deleting their computers.

Default-on has two exceptions. Teams on Privacy Mode (Legacy)A Cursor data setting that blocks Grok Bot because the product requires cloud data storage. Press Enter for the full definition. and teams on a legacy request-based plan stay off, and there is no switch to turn it on or off for Teams.

Admins on either plan can bring members in with Invite Team on the Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. page. Existing Cursor users get an email with a download link. New users get an invitation to your Cursor team, by email or invite link, that also points them to Grok Bot. Teams that manage membership through SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. see only the existing-users option. To install the desktop app on managed devices yourself and plan updates, the separate deployment guide covers it.

Cursor lists five items to settle before you roll Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. out. Privacy Mode (Legacy)A Cursor data setting that blocks Grok Bot because the product requires cloud data storage. Press Enter for the full definition. blocks Grok Bot outright.

• Move off Privacy Mode (Legacy)A Cursor data setting that blocks Grok Bot because the product requires cloud data storage. Press Enter for the full definition.. It blocks Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. entirely, and you are prompted to change it before enabling.
• Plan for shared egress addresses if your company restricts services by source IP.
• Clear your gateway. If devices sit behind Zscaler or another TLS-inspecting proxy, allow Cursor's domains, including the nested *.*.cursorvm.com pattern, and exempt them from inspection before members connect.
• Decide how members sign in to company tools from the computer.
• Review the policies Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. inherits: Team RulesRules promoted to apply across a whole organisation and shared consistently between the Cursor IDE, Agent and Bugbot. Press Enter for the full definition. and the connector policy on every plan, plus team Auto-review rules and the MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. allowlist on Enterprise.

For the gateway item, the docs say to allow Cursor's domains and exempt them from inspection before members connect.

Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. inherits your team's Cursor connector policy. There is no separate Grok Bot connector list, and connectors appear as plugins in the app. You choose which servers members can use from your Team Marketplace on the Plugins & MCPs page of the dashboard, not on the Grok Bot page. Any permitted connector is available to every Bot a member runs. Pushing connectors to members, whether mandatory or default-on, is not available.

Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. is a computer-use agent that operates applications, browsers and development environments. It runs in Cursor's cloud, each user's work executes on a dedicated cloud computer, and the desktop and mobile apps are thin clients for chat, review and approvals.

• Per-user isolation: each user's work runs in a dedicated Firecracker microVM with hardware-level separation from other users.
• No access by default: a Bot can use only the accounts and plugins the user or team grants it.
• Human approval gates: sensitive actions need user approval, evaluated by an independent review model called Auto Review.
• Administrative control: admins can set Team RulesRules promoted to apply across a whole organisation and shared consistently between the Cursor IDE, Agent and Bugbot. Press Enter for the full definition., Cloud Agent delegation, template sharing and the local execution ceiling.

The boundary between users is hardware-level, with its own kernel, memory and virtual devices per computer, Within one user it is different: every Bot that user runs shares the same computer, and Bots isolate personalities and workspaces, not compute. A login or file on the computer is available to every Bot that user runs.

The docs draw three practical conclusions from that. Sign the browser out of accounts a Bot no longer needs, remove sensitive temporary files when work completes, and when a workload needs its own computer and credential set, give it its own Cursor user.

Team Bots are the exception to one Bot per user. A member publishes a cloud-hosted Bot to the team and every member can chat with it. Each member's chat is private, including from the owner. In a member's own chat the Bot usually works on that member's computer, uses that member's connected accounts after asking, and uses that member's Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. usage. In Slack channels, threads and group chats, a Team Bot uses one computer of its own.

Most Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. settings sit on the Grok Bot page of the Cursor dashboard, which only admins see. A few live in Team Settings, your Team Marketplace or your identity provider. The table below marks which plan each control needs and what it does when you have not touched it.

Allow Sudo on Bot Computers and Allow Local Egress Routing are on out of the box, Enforce Auto-review, Agent Email and Action Recording start off, and a team without a network policy is allow-all. Existing computers pick up a sudo change after they restart, and turning local egress routing off stops active routes within five minutes.

Execution on Local Computer caps what Bots may do on a member's own machine through the desktop app: open files and run tasks. Always allow, the default, leaves the choice to each member, whose own setting defaults to asking before every task. Ask every time makes every local task ask for approval, and Never allow turns local execution off for the whole team. A member's own setting still applies when it is stricter than the team's. The docs say to pick Never allow unless Bots have a specific reason to work on member machines.

Team-wide Ask first and Allow automatically rules apply to every member's Bots on top of their own, members see them under Settings, General, Auto-review but cannot edit or delete them, and Ask first wins when rules conflict. Turn Enforce Auto-review on before you rely on those rules, because turning enforcement off stops applying them. Enforcement also covers Team Bots in chats where nobody can answer an approval, such as teammates' chats and Slack, which otherwise run without Auto-review.

For most controls a group can only widen: it can grant its members more than the team allows, never less, and a member in several groups gets the most permissive result. So tighten on the Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. page and widen per group. Network policy is the one exception. A group policy replaces the team policy for its members, looser or tighter, and a member of several groups gets the most restrictive one, unless the team policy is locked, in which case it applies to everyone.

• Bot Capabilities: allow Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition., Agent Email or Allow Local Egress Routing, or raise the Execution on Local Computer ceiling. Don't enforce for this group lifts the Enforce Auto-review lock, and group Auto-review rules combine with the team's.
• Network: the group's own network policy.
• Group Rules: rules for the group's Bots, combined with Team RulesRules promoted to apply across a whole organisation and shared consistently between the Cursor IDE, Agent and Bugbot. Press Enter for the full definition.. Members cannot turn them off.
• Setup Scripts: manifests that run on group members' computers alongside Team Setup Scripts. They read the same Team Secrets, and there are no group-level secrets.

Group settings apply to groups your team owns, whether you manage membership by hand or sync it through SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition., and they are separate from Organization Groups. To control who can use Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. at all, use Manage Group Access on the Grok Bot page instead. Group settings are Enterprise only.

For security-sensitive deployments the docs give a recommended baseline of eight items for admins and five for members. Three of the admin items are Enterprise only: Network Controls, Enforce Auto-review and team Auto-review rules.

1. 1Configure Network Controls. Teams without a policy default to allow-all, and self-serve Teams cannot set one.
2. 2Audit connector policy in the Team Marketplace before enabling Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition..
3. 3Turn on Enforce Auto-review before you rely on team rules.
4. 4Set Execution on Local Computer to Never allow unless Bots need to act on member machines.
5. 5Disable Cloud Agent spawning if you do not need delegation.
6. 6Keep public template sharing off unless members should publish Bot templates outside the team.
7. 7Add team Auto-review rules. Production deployments, external email, payments and accepting legal terms are good Ask first examples. Keep automatic rules narrow.
8. 8Gate sign-in to managed devices through your identity provider.

Two items state their own sequencing: audit the connector policy before enabling Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition., and turn on Enforce Auto-review before relying on team rules. The last item has a limit: Grok Bot sign-in uses your SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition., so a device-aware sign-in policy applies to it, but that gates sign-in, not the hosted computer itself.

Auditing is split across three places. Audit logs cover admin, security and authentication events plus Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. control-plane events such as Bot creation, member access changes, Team Setup manifests, MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. authentication, Slack account links and routines, and you view them on the Audit Log page or stream them to your SIEM. Action Recording covers what the Bots actually did. OpenTelemetry Export is how you receive those recordings in your own collector.

Recorded Action Recording events do not appear on the Audit Log page. They arrive through OpenTelemetry Export, configured under Team Settings, tagged cursor.surface=grok_bot. Action Recording is off by default, and the switch is on the Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. page.

What gets recorded is metadata, sanitized before it is stored or exported. Shell commands are secret-scrubbed. Browser navigations keep each page as scheme://host/path with the title but strip query strings and credentials. Computer use sessions record action and screenshot counts and the session duration, without the screenshots, clicks or typed text. Every other event carries ids, outcomes and durations, never tool arguments, file paths or message content.

You can drive most of this from code. The Admin API covers enabling Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. and managing capabilities, Enforce Auto-Review, group access, network policy, team rules and setup scripts. Team Secrets are managed from the dashboard only. To recreate, terminate or delete members' computers from a script, the Organization API takes an Organization API key with the admin:* scope, because one computer serves every team a member belongs to.

The docs give five items for members.

• Never paste credentials into chat. The masked secret request is the supported path.
• Prefer Allow once over Always allow for actions that touch accounts, money or shared resources.
• Sign the Bot's browser into accounts sized to the task, sign it out of accounts it no longer needs, and use scoped service accounts where the source system supports them.
• Start new roles with read-only tasks and draft outputs, and keep sending, publishing, purchasing, deletion and production changes behind approval.
• Review installed plugins and active routines regularly, and pause a routine when its source system changes.