Grok Bot for Enterprise: bots act as the signed-in user

Always-on AI agents stopped being a top-tier add-on and became something your admin has to govern. xAI shipped Grok Bot for Enterprise on September 3 with access, network, and audit controls, two days before the app landed on iPad. The control list is solid. The line worth underlining is buried in the security docs: a bot has no identity of its own — it acts as the member who signed it in.

What actually happened

Per xAI's announcement, Grok and Cursor Enterprise customers get two weeks free and can invite their whole organization, including people without existing seats. That follows an August pricing slide that put Grok Bot in every SuperGrok and Cursor tier down to Cursor Pro at $20 a month, after launching on top-tier plans only in mid-August.

The enterprise-only surface, per xAI's security documentation, is eight controls: an organization-wide enable switch, Network Controls (an admin-set policy for where team computers may connect), Action Recording with scrubbed shell commands, computer management so an admin can terminate a member's machine from the dashboard, audit logs covering admin, security, and authentication events, OpenTelemetry export of sanitized action events, an MCP allowlist, and SCIM 2.0 provisioning and deprovisioning.

The identity model is explicit. Bots "act as the signed-in member" and cannot exceed that person's access. Connector tokens stay on the backend and bots invoke tools without receiving OAuth tokens. For sensitive inputs, the bot hands the computer back to the human rather than typing credentials, and secure requests mask values from transcripts and the model.

Why agent governance matters for your business

We wrote in August that the credential question was the thing to answer before turning one of these on. xAI's answer is a defensible one — every action stays attributable to a named person — but read what it implies. A bot's blast radius is exactly one employee's accumulated permissions. If your ops lead has production database access, prod write access is now inside an autonomous loop, attributed to them, running while they sleep.

So the enterprise controls are necessary and not sufficient. What actually caps the damage is the thing you own: least-privilege on the human account the bot runs as. Three moves, in order. Create a purpose-scoped account for agent work instead of attaching bots to a senior person's login — SCIM makes that cheap now. Ship the OpenTelemetry export into whatever you already use for logs on day one, not after an incident, so agent actions sit next to application events in the same query. And turn on the MCP allowlist before anyone gets creative: an unallowlisted MCP server is an arbitrary tool with your employee's permissions.

The $20 tier is the real story. Governance you can only afford at the enterprise SKU is governance your team will route around on a personal plan.

Sources: SpaceXAI, SpaceXAI Grok Bot security docs, 9to5Mac.