Company wide - "cannot auto-allow" commands

Describe the request

Use-case is that we want to have a company wide policy where X commands cannot be run automatically - must require explicit approval. Otherwise agents could cause incidents.

Operating System (if it applies)

MacOS

Hey @Aidan_Do1!

I think Enforcement Hooks might be what you’re looking for!

Hey @Colin as I understand, hooks are not enforcing in nature if these sit in the developers machine and can be commented out for a session where a developer wants cursor to execute a command. These are more of agent guardrails, what would be a way to govern the AI usage and restrict the usage of certain MCPs/commands/file accesses at an enterprise level?

Hey @Sarang_Gupta!

Hooks can be distributed via MDM / Team Settings (from the Cursor Dashboard), which you can read more about here! In these cases, a developer wouldn’t be able to just “comment them out”.

The Enterprise Plan also lets you configure or allowlist MCP servers/commands.