Enable Action Recording and manage org Grok Bot computers

Two Enterprise-only controls on the Grok Bot page of the Cursor dashboard cover Bot-action visibility and emergency computer termination. Official guides: Grok Bot for teams and enterprises → Admin controls; Grok Bot security → Logging and audit / Identity.

Self-serve Teams do not get either control.

Action Recording

Action Recording captures Bot actions (including scrubbed shell commands) in an internal store. It is off by default. Retention is 90 days.

1. Open Grok Bot as an Enterprise admin.
2. Find Action Recording and turn it on when your review requires it.
3. Know that Action Recording events do not appear on the Audit Log page.
4. To receive sanitized events in your own collector, configure OpenTelemetry Export under Team Settings (also Enterprise only).

Audit Logs are a separate Enterprise pipeline for admin, security, and authentication events (dashboard or SIEM stream). Privacy Mode (Legacy) forces Action Recording off.

Computer management (organization admins)

Computer management is Enterprise only and limited to organization admins. Team admin rights are not enough, because a computer spans every team the member belongs to.

Organization admins can:

1. Look up any member’s Grok Bot computer.
2. See when it was created and last active.
3. Terminate it.

After terminate: the durable disk is kept, and the member’s next session starts a fresh computer. Also revoke sessions in your identity provider. Application sessions persist only on the member’s computer until that cleanup.

Use terminate for quick access revocation (leaver, compromised session, forced re-login), then finish IdP revoke and member cleanup (pause routines, sign out of sites on the computer, uninstall plugins, remove sensitive /workspace files).

Member-side cleanup that still matters

Deleting a Bot does not remove computer files or browser sessions. When a project or login should no longer be available, members should:

1. Pause or delete related routines.
2. Sign out of websites on the computer.
3. Uninstall plugins and revoke authorization in the source service.
4. Remove sensitive files from /workspace.

Pitfalls

• Action Recording on alone does not send events to your SIEM — wire OpenTelemetry Export for that path.
• Audit Logs ≠ Action Recording; check the right page for the event type you need.
• Team admins cannot terminate member computers — escalate to an organization admin.
• Terminate keeps the durable disk; it is not a full wipe of historical files.