Tailscale setup for Grok Bot

Grok Bot desktop has one Tailscale row: Connect apps → Your plugins → Tailscale. The row has one slot per tailnet, labeled with the tailnet name first, then Personal or the team name, then the .ts.net address.

A member can connect several company tailnets at once, plus one personal tailnet at a time. They can add more personal tailnets, but only one is live; to switch, they make another one the default, which parks the current one. An address under a tailnet's .ts.net name goes to that tailnet. A short name or a 100.x address goes to the member's default tailnet. They change the default by asking Grok Bot.

Grok Bot shows an Allow/Deny card before it removes a device, adds a tailnet, or changes the default. Wait for Allow.

Reach tailnet MCP servers through this row. A Tailscale client installed on the bot's computer is wiped when that computer is replaced.

Use one path per tailnet.

Company tailnet

A team admin turns this on once, at cursor.com Integrations → Tailscale. In the Enable Tailscale dialog, enter the tailnet name or click Sign in to Tailscale, check Members' Grok Bot devices may join this tailnet, and click Enable. The tailnet needs Tailscale Premium or Enterprise.

Each member gets their own Grok Bot device, and that device carries the custom:grokbot attribute. Limit that device with postures. Without the posture, the device has the member's own access.

Merge the keys below into the existing policy file. If the policy already has default postures, add "custom:grokbot NOT SET" inside each of them and leave defaultSrcPosture as it is.