Run Everything and Auto-review greyed out on Teams plan; team policy sets enableRunEverything false with no dashboard control

[leo_inflow (Leo Mahon)]

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

On our Teams plan (not Enterprise), Settings > Agents > Approvals & Execution > Run Mode is locked to Allowlist. Run Everything and Auto-review are greyed out for me, and I am the team admin.

The team policy the client downloads contains:
“autoRunControls”: {
“enabled”: false,
“enableRunEverything”: false,
“enableSmartAuto”: false,
“enableAllowlistMode”: true
}
(seen in the cached adminSettings.cached / autorun.cachedAdminSettings keys in state.vscdb; it is re-fetched from the server on restart)

There is no Run Mode / Auto Run Configuration setting in our team dashboard, since that’s Enterprise-only. Staff confirmed in How do I disable Agents for a Team that Teams plans can’t centrally disable Run Everything, so we shouldn’t be receiving this restriction.

Run Everything worked yesterday on 3.21.9. It stopped after updating today.

Possibly related: team admin auto-run controls moved to Enterprise in Feb (Teams Admin changes). We may have an old stored policy we can no longer view or edit.

Steps to Reproduce

1. Teams plan account (team ID 8931757), signed in as team admin
2. Update Cursor from 3.21.9 to 3.24.18 / 3.26.16
3. Open Settings > Agents > Approvals & Execution > Run Mode
4. Run Everything and Auto-review are greyed out; only Allowlist is selectable
5. Fully quitting and reopening Cursor doesn’t help

Expected Behavior

On a Teams plan with no Enterprise run-mode policy, all run modes should be selectable, as they were on 3.21.9. Alternatively, admins should be able to change this policy in the dashboard.

Screenshots / Screen Recordings

Operating System

MacOS

Version Information

Version: 3.26.16
Commit: 8fcb8ace5c73fa31f2e2707fd6783160e4ed3e40
VSCode: 1.128.0

Does this stop you from using Cursor

Sometimes - I can sometimes use Cursor

[Colin]

Hey @leo_inflow,

The restriction isn’t coming from your team. It’s coming from a file on your machine, ~/.cursor/permissions.json, which is what the “Enforced by ~/.cursor/permissions.json” label in your screenshot points to. The autoRunControls block you found (with "enabled": false) is the normal “no team policy” default every Teams plan gets, and when enabled is false Cursor ignores the other values in it and uses your own settings.

When that file defines a terminalAllowlist or mcpAllowlist, Cursor switches Run Mode to Allowlist and disables Run Everything, which is what the note under Run Mode says. Auto-review being disabled along with it is a known issue the team is already tracking, and I’ve added your report to it.

To get all run modes back:

1. Open ~/.cursor/permissions.json in an editor.
2. Remove the terminalAllowlist and mcpAllowlist entries (copy them first if you want to keep them), or rename the file, e.g. to permissions.json.bak.
3. Save. Cursor re-reads the file automatically, so Settings > Agents > Approvals & Execution > Run Mode should list Auto-review and Run Everything again.
4. If you still want those commands allowlisted, add them in the allowlist under that same Settings section instead.

If you’re connected to a remote machine, Cursor reads the file from that machine’s home folder, so check there too. The file format is described in the permissions.json reference.

If you didn’t create that file yourself, could you tell us what keys are in it (leave out anything sensitive)? That would help us work out why it changed between versions.