Control level
| What | Level |
|---|---|
| Shell commands, MCP tool calls and file reads | Enforced with the enterprise hooks.json in its root-owned location |
| File edits, Cursor's web search and fetch tools | Not covered: Cursor has no hook before them |
| Model traffic | Network, partial: only chat with a custom model through a custom OpenAI base URL |
The level was verified on 2026-10-15 against Cursor's documented hooks (hooks.json version 1, Cursor 2.x) by running Cursor's documented hook input through the real enforcement hook and daemon. Cursor itself is closed source and was not run.
1. Write the policy and enrol the machine
Write rules in Agent policy (Agent policy) and enrol the machine with the endpoint agent (Deploy). The agent fetches the policy compiled for the cursor engine and installs hooks.json in Cursor's enterprise location:
| OS | Location |
|---|---|
| Linux | /etc/cursor |
| macOS | /Library/Application Support/Cursor |
| Windows | C:\ProgramData\Cursor |
The file registers Govern's enforcement hook on beforeShellExecution, beforeMCPExecution and beforeReadFile, with failClosed: true: a crash, timeout or invalid output blocks the action. Hooks from every source run, and a deny outranks every other answer.
2. What is not covered
- File edits. Cursor has no hook before an edit (
afterFileEditonly reports it), sofile_writerules are gaps for Cursor. - Cursor's own web search and fetch tools.
beforeReadFilein thecursor-agentCLI, which Cursor's forum reports as not implemented.
Shell and MCP hooks can ask the developer; beforeReadFile turns an ask into a block. Check the gaps on Agent policy > Policy preview with the engine cursor.
A hooks.json in user or project configuration is not locked, and Cursor runs the action when such a hook script fails. Only the enterprise location gives the Enforced level.
3. Route custom-model chat through the gateway
In Cursor Settings > Models:
OpenAI API Key: <token printed by keystone-cli token models --tool cursor>
Override OpenAI Base URL: <your API URL>/api/v1/models/gateway/v1
Custom model: <model id>- Run
keystone-cli token models --tool cursorand copy the token. - Enter the values above, add a model you may use and enable only that model for chat.
- Paste a new token when it expires (at most one hour).
Only chat that uses the custom model reaches the gateway. Cursor sends these requests from its own servers, so the URL must be reachable from the internet, which rules this out for an air-gapped installation. Tab completion and Cursor-hosted models never reach Govern.
Cursor pages in the console
The AI tool controls service (marked beta) has Cursor, Cursor policies, Cursor events and Cursor settings pages for Cursor's own policy evaluation and costs. Policy changes need controls:manage. These are a narrowing layer; agent policy is authoritative.
Audit
Cursor's own audit data can be pulled by a vendor audit connector; see Evidence.