Cursor Adds Enterprise Model Controls, Soft Spend Limits, and Richer Usage Analytics

Cursor's May 4, 2026 release gave Enterprise admins more granular model access controls, soft spend limits with automatic alerts, and more detailed usage analytics. The June 1, 2026 deadline for moving old blocklists to the new model controls has passed; as of October 9, 2026, admins manage model access under Team Settings, Models in the dashboard. (Cursor changelog (May 4, 2026))

Key Takeaways

• Model controls: allow or block lists at the provider and model level, including specific configurations by speed or context window size, with an option to block new providers or model versions by default.
• Migration deadline passed: teams with old blocklists had until June 1, 2026 to move to the new system.
• Where it lives now: Team Settings, Models, Model Providers (Enterprise only), with Organization Groups able to widen access for specific cohorts (Cursor enterprise docs).
• Soft spend limits: soft limits warn instead of blocking, and Cursor alerts users at 50%, 80%, and 100% of soft or hard limits.
• Usage analytics: filter by user and break down by clients, Cloud Agents, automations, Bugbot, and Security Review.

What's New

Model Access Controls (Providers, Models, and Configurations)

Admins can now set allowlists/blocklists at both the provider and model level, including the ability to block entire providers or specific model configurations (for example, based on speed or context window size). (Cursor changelog (May 4, 2026))

Enterprises can also choose to block new providers or model versions by default. (Cursor changelog (May 4, 2026))

Cursor gave organizations that already used blocklists until June 1, 2026 to migrate to the new system. (Cursor changelog (May 4, 2026))

Soft Spend Limits and Automated Usage Alerts

Instead of hard limits that block users, admins can set soft limits and receive automated alerts as users approach their thresholds (50%, 80%, and 100% of either soft or hard limits). (Cursor changelog (May 4, 2026))

Usage Analytics by User and Product Surface

The usage analytics tab now supports filtering by individual users and breaking usage down by product surface. Cursor lists these surfaces as:

• clients
• Cloud Agents
• automations
• Bugbot
• Security Review

(Cursor changelog (May 4, 2026))

How Model Access Works Now

Cursor's Model and Integration Management docs describe two places to configure model access as of October 9, 2026:

1. Team Settings, Models (Enterprise only). The Model Providers section manages providers, models, defaults, and personal API key (BYOK) controls. This is the team baseline.
2. Organization, Groups, Models, for teams using Organization Groups, to widen access for specific cohorts.

The two layers combine on a most-permissive basis: a model is allowed if the team or any of the user's groups allows it. Cursor's advice is to put the strictest defaults on the team and use groups only to grant extra models. New models are not switched on for every enterprise team at once; Enterprise teams opt in. The same controls are scriptable through the Admin API model access routes.

One practical catch from the docs: Auto-review's classifier falls back to Claude 4.5 Haiku, and blocking that model can disable Auto-review in the IDE.

Corrections and Updates

• October 9, 2026: This page described the June 1 blocklist migration deadline as upcoming; that date has passed, and model access is now managed under Team Settings, Models, Model Providers.

Sources

• Cursor changelog, "Model controls, spend management, and usage analytics" (May 4, 2026), read 2026-10-09: https://cursor.com/changelog/05-04-26
• Cursor docs, "Model and Integration Management", read 2026-10-09: https://cursor.com/docs/enterprise/model-and-integration-management
• Cursor docs, "Admin API" (model access, spend limits), read 2026-10-09: https://cursor.com/docs/account/teams/admin-api