1 min lesson
What the admin plane actually exposes
Rebuild the parts of "What the admin plane actually exposes", then say why each one matters.
Step 1 of 2
What the admin plane actually exposesconcrete console levers
Don't leave 'admin plane' abstract in front of an auditor. Name the levers. The admin console gives you the cost, access and data-exposure controls plus the measurement surface that turns AI adoption into a number leadership can read:
- Audit logs
- Track authentication, user changes and settings changes - the immutable who/what/when record
- Spend controls
- Spend alerts + group limits at individual / group / team level, so no runaway spend surprises you
- Restrict-analytics toggle
- On = analytics for admins only; off = democratized to all users
- `.cursorignore`
- The data-exposure lever - excludes paths from indexing and agent reach, set org-wide
- Central push + invocation analytics
- Push skills, hooks and MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. integrations to the whole team from one place, then see how many of each are being invoked across the org
The analytics suite goes deeper than 'how much is it used.' It breaks down usage by surface (IDE / cloud agents / CLI) and by model (relating spend to token efficiency), classifies work (new feature vs bug fix vs maintenance), shows the agent-mode split (plan vs ask vs writing code), plan-mode adoption and even a prompt-specificity score. Lots of low-specificity prompts or expensive models on trivial tasks tells you exactly where to invest in training. (No analytics MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. server yet; this is reached via the analytics/admin APIs.)
Learn more
Advanced table
Customer concern
- Customer concern
- 'Offboarded engineer still had access'
- Family
- Identity
- Cursor control
- SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. auto-deprovision + SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition.
- Customer concern
- 'Our code can't train a model'
- Family
- Data
- Cursor control
- Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. + zero-data-retention terms
- Customer concern
- 'Agents must not call arbitrary tools'
- Family
- Policy
- Cursor control
- MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. allowlist + hooks
- Customer concern
- 'No traffic over the public internet'
- Family
- Network
- Cursor control
- PrivateLinkAn AWS connection Cursor uses for private Git provider and repository-origin traffic; it does not cover model-provider traffic. Press Enter for the full definition. / Cloudflare Tunnel
- Customer concern
- 'Prove what the AI changed'
- Family
- Visibility
- Cursor control
- AI-code tracking + audit logs
- Customer concern
- 'Different rules per business unit'
- Family
- Org-wide
- Cursor control
- Organizations + Groups
| Customer concern | Family | Cursor control |
|---|---|---|
| 'Offboarded engineer still had access' | Identity | SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. auto-deprovision + SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. |
| 'Our code can't train a model' | Data | Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. + zero-data-retention terms |
| 'Agents must not call arbitrary tools' | Policy | MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. allowlist + hooks |
| 'No traffic over the public internet' | Network | PrivateLinkAn AWS connection Cursor uses for private Git provider and repository-origin traffic; it does not cover model-provider traffic. Press Enter for the full definition. / Cloudflare Tunnel |
| 'Prove what the AI changed' | Visibility | AI-code tracking + audit logs |
| 'Different rules per business unit' | Org-wide | Organizations + Groups |