Grok Bot for IT admins: Network Controls, Action Recording, and the audit trail

Disclosure: aitamer.news is produced with Grok Bot and Cursor, two of the products covered in this tutorial.

Episode 25 covered sign-in and bulk computer management. Episode 26 covered reaching private services. This one is the allowlist and audit step: which destinations computers may call, what gets recorded when a Bot acts, and how that trail reaches your collector.

The sources are the SpaceXSI teams and enterprises, security, and security FAQ pages, plus Cursor’s OpenTelemetry Export page, all read 10 November 2026. Network Controls, Action Recording, Audit logs, and OpenTelemetry Export are Enterprise only. This desk has no Enterprise team, so nothing here was tested; if a label differs from your dashboard, follow the dashboard.

Two different trails

Cursor keeps admin events and Bot actions on separate pipes:

Trail	What it covers	Where it shows up
Audit logs	Admin, security, and authentication events, plus Grok Bot control-plane events (Bot creation, member access changes, Team Setup manifests, MCP authentication, Slack account links, routines)	Audit Log page, or stream to your SIEM
Action Recording	What a Bot did: tool calls and decisions, connector calls, scrubbed shell commands, browser navigations, computer-use summaries, file transfers, messages sent, routines, guardrails, skills read, work handed to subagents	Your collector via OpenTelemetry Export (cursor.surface=grok_bot); not on the Audit Log page

Self-serve Teams do not get the audit log. Action Recording is Enterprise only, and Privacy Mode (Legacy) forces it off.

Network Controls

Find Grok Bot Network Access under Network on the Grok Bot page of the Cursor dashboard. Pick a mode:

Mode	Effect
Allow All Network Access	All destinations (also the default when no policy is set)
Defaults + Team Allowlist	Cursor’s default destinations plus your list
Team Allowlist Only	Only your list, plus the destinations a computer needs to function

Destinations are web domains and IP ranges with ports; there is no cap on entries. Directory groups can carry their own policy; a lock makes the team policy apply to everyone. The policy is separate from Cloud Agent network settings. Running computers pick up a change within about a minute; sleeping ones apply it when they next wake; you do not need to recreate them.

Blocking an app does not block that service’s website. The connector policy and the network policy are separate layers; closing both paths takes both controls. Restricting egress limits where data can leave; to check what reaches the model against your own DLP policy, use inference hooks (covered in episode 24).

Apply to MCP servers

In an allowlist mode, the Apply to MCP servers switch appears below the destination list. It is off by default. When it is on, every connected app, including built-ins such as GitHub, X, Origin, Google Workspace, and Microsoft 365, must match an allowed destination by the hosts it sends requests to. A Bot’s connection to one that does not match is refused, with a message that names the host to add. Command servers that run on the computer are unaffected; the network policy already covers them.

Turn the switch on only after the hosts are listed. An allowlist mode by itself does not restrict remote MCP servers. Directory groups inherit the switch and cannot turn it off. Saving it does not restart computers; it applies to the next MCP connection. It is separate from Team Settings → MCP Configuration for the editor.

The security page lists the hosts each built-in connector needs (for example api.github.com for GitHub, graph.microsoft.com for Outlook/OneDrive/Teams, api.tailscale.com and login.tailscale.com for Tailscale). Marketplace connectors are checked by the host in their server address on the Plugins & MCPs page.

Action Recording

The switch lives on the Grok Bot page and is off by default. When it is on, Cursor records Bot actions as metadata, sanitized before storage or export: shell commands are secret-scrubbed; browser navigations keep scheme://host/path and the title but strip query strings and credentials; computer-use sessions record action and screenshot counts and duration, without screenshots, clicks, or typed text; other events carry ids, outcomes, and durations, never tool arguments, file paths, or message content. The OpenTelemetry page also says exported browser URLs drop fragments, and that a webhook or share-link token in the path is redacted. Retention in Cursor’s store is 90 days.

Recorded events do not appear on the Audit Log page. To receive them in your own collector, configure OpenTelemetry Export.

OpenTelemetry Export and Audit Log

Configure OpenTelemetry Export under Team Settings → OpenTelemetry Export. It streams Cursor usage metrics and logs, including recorded Grok Bot actions tagged cursor.surface=grok_bot, to a collector you run. That is the customer path for Action Recording. The export page links to its Wire Reference for event and attribute details.

Conversation content (prompts, responses, and optional tool I/O payloads) is a separate, opt-in family on the same export. It is the only family that carries message text or tool payloads. For Grok Bot MCP calls, keep Action Recording on as well so every tool-I/O row has an mcp_tool_call row to join to.

Audit logs stay on their own path: view them on the Audit Log page (filter by application to Grok Bot) or stream them to your SIEM. Use Audit Log for control-plane and admin events; use Action Recording plus OpenTelemetry for what Bots did.

Related Enterprise toggles on the same page

A few neighbors on the Grok Bot page sit next to these controls and are easy to confuse with them:

• Allow Sudo on Bot Computers (under Bot Computers) lets Bots run commands as root on their own computer. It is on by default; existing computers pick up a change after they restart.
• Team Setup Scripts and Team Secrets were episode 26. A script can install a networking client for private services. Team Secrets are environment values those scripts read, and the teams page says they are not made available to Bots directly. These pages do not say whether traffic through that client still has to match Network Controls.
• Manage Member Computers and Data (recreate / terminate / delete) was episode 25. Recreate moves members to the latest image and Team Setup Scripts; a Network Controls change does not require that recreate.
• Data retention settings under Data Retention can delete Bots no one has messaged, a member’s computer once no one has messaged any of their Bots, and Bot messages and attachments older than a period you choose. Each is off by default.

The security FAQ also answers the usual IT questions in short form: dedicated egress IPs are not available (shared static egress only), on-premises deployment and bring-your-own-image are not supported today, and certifications for the Grok Bot surface are listed on the security page.

A short rollout order

1. Decide the Network Controls mode. Start with Defaults + Team Allowlist unless you already know every destination.
2. Add the hosts your connectors and private clients need (including Tailscale or Cloudflare Tunnel endpoints from episode 26) before you tighten the mode or turn on Apply to MCP servers.
3. Pilot on one group if you use directory-group policies; lock the team policy only when the list is stable.
4. Turn on Action Recording when compliance needs a scrubbed action trail; point OpenTelemetry Export at your collector and confirm cursor.surface=grok_bot events arrive.
5. Leave conversation-content export off until legal and security have signed off on message text leaving Cursor.

Network Controls shape where computers can talk. Action Recording and OpenTelemetry say what a Bot did. Audit Log records admin, security, and control-plane events. Keep those jobs separate, and re-read the dashboard labels on the day you flip each switch.