Enterprise & Compliance

Grok Bot for Teams and Enterprises

Grok Bot gives each person on your team standing Bots for everyday work: research, operations, documents, browsing, and automations. This page is for team and organization admins rolling Grok Bot out.

Architecture & MicroVM Isolation

Grok Bot is a computer-use agent that operates applications, browsers, and development environments. Each user's work executes on a dedicated cloud computer running inside an isolated Firecracker microVM.

  • Hardware-level Separation: Dedicated kernel, virtual devices, and memory per user.
  • Zero Trust by Default: A Bot has no access to company systems until explicitly granted.
  • Independent Auto Review Engine: Analyzes tool invocations, shell executions, and destructive actions.

Admin Controls & Network Lockdown

On Enterprise plans, administrators manage deployment from the Cursor dashboard:

  • Network Controls: Enforce strict egress allowlists (domains and CIDRs) across all cloud computers and MCP connectors.
  • Team Setup Scripts & Secrets: Declarative shell manifests with encrypted environment variables to standardize tooling across all user machines.
  • Enforce Auto-review: Lock safety review rules on, preventing members from bypassing approval gates on high-risk commands.
  • Action Recording & OTel Export: Real-time streaming of all agent actions, tool calls, and review decisions to corporate SIEMs via OpenTelemetry.

Recommended Security Baseline

  1. Audit connector policy in Teams Marketplace before rollout.
  2. Configure Network Controls with an approved domain allowlist including MCP hosts.
  3. Turn on Enforce Auto-review before relying on team rules.
  4. Set Execution on Local Computer to Never allow unless member host execution is strictly required.
  5. Disable Cloud Agent spawning if delegated background coding is not needed.