Grok Bot permissions: set boundaries the app actually enforces

A Grok Bot permission boundary only holds if a setting enforces it: Ask first rules, draft cards, what you put in Vault, and the local-execution switch. Instructions in a prompt and Auto-review's judgment help, but the docs say neither is an absolute guarantee, and separate Bots share the same computer, files and logins.

At a glance#

Paraphrased from docs.x.ai, Cursor's help and the changelog as of October 28–29, 2026. The worksheet and brief below are our suggestions; apply your organization's own access policy where it exists.

Why another Bot isn't a wall#

The official overview says Bots on one account share computer files, sessions and logins. Creating a "Finance Bot" and a "Social Bot" gives you two roles, not two vaults. Anything one signs into, both can use — and the same goes for every Vault item. If two jobs must not share access, use a separate Cursor user, which gets its own computer. Our shared computer guide explains the mechanics.

Rules: how each type behaves#

Ask first vs Allow automatically#

Ask first always stops a matching action for you. Allow automatically lets an action through only if Auto-review sees no other reason to stop it. When both match, Ask first wins. These saved rules became Custom Rules in 0.68.0.

Where rules apply#

The approvals docs (checked October 25) say personal rules save to your account, so they apply on every desktop and on mobile. Team-locked rules can't be edited, and your personal rules can only make behavior stricter than the team's.

The Permissions screen#

Since 0.77.0 (October 26, needs 0.75.2+), Settings → Permissions lists every rule under Always Ask and Allow without Asking, each with an Add Rule button. Chat rule cards show rules as sentences and name any older Allow rule removed to make room. This is your audit view.

Rules proposed from chat#

Since 0.75.8 (October 24), a Bot can offer to add, change or remove a rule on a card you confirm. A confirmed card equals a Settings change and persists across chats. Read the verb and the target; decline anything broader than you'd write yourself.

Approvals, Auto-review and the October shift#

Approval cards show the action and inputs. Since 0.75.2 Auto-review cards describe it in one sentence, name the app with its logo, and flag irreversible or sensitive changes. Since 0.75.5, denying a card stops the Bot from retrying that action until your next message. Since 0.77.0 cards stay open 30 minutes instead of 10.

Auto-review is asking less often:

• 0.75.5: fewer cards for actions you asked for in your own words; it no longer approves an action your request said to stop before.
• 0.75.8: a second look before showing a card; a Bot editing its own routines isn't risky by itself.
• 0.77.0: more undoable private actions pass; background work you start in your own words doesn't ask to start.

The consequence: if you rely on seeing a card, write an explicit Ask first rule instead of expecting one.

Sending is now a wording decision#

Since 0.75.5, an email or Slack message you ask for in chat goes out once Auto-review allows it. "Draft a reply" and "send a reply" now produce different outcomes. Cursor's agent email help says email from a routine or any turn you didn't start with that request still waits as a draft, and instructions inside a received email never count as permission to send. 0.64.0 lets you disable drafts per Bot — don't, until a Bot has sent several messages correctly.

Unattended approvals expire#

Approvals raised by routines, triggers or other Bots expire after about 30 minutes and the action doesn't run (Cursor's help and docs, checked October 29). That's a safe failure that can stall work. Turn on notifications for routine-owning Bots rather than widening Always allow. Your starred primary Bot can offer to take on work since 0.66.0; an offer isn't approval.

Boundaries the October releases moved#

For passwords, take over the Bot's screen and type them, or use a secure secret request where a connection offers one. No release through 0.75.5 mentions the October 5 Secure Form snapshot report. Never put secret values in a brief, a skill or a shared example. More in Is Grok Bot safe?.

Write boundaries as verbs and targets#

"Be careful with email" can't be checked. "Read the Invoices label and draft replies; do not send, forward, archive or change labels" can. Do the same for any system: name the resource and the allowed operation.

For recurring jobs, split work into three stages so you can decline the last one without losing value:

1. Gather evidence.
2. Propose a specific change.
3. Apply only an approved change, if authorized.

Boundary worksheet#

• Systems the task needs, with the smallest workable account permission for each.
• Allowed operations, in plain language.
• Prohibited operations, in plain language.
• What every approval request must show: exact target, before and after values, likely effect.
• A harmless test sample proving the workflow pauses where intended.
• A matching Ask first rule for every prohibited verb, visible on the Permissions screen.
• A review date — revisit when you add a Bot, a connection or a new responsibility.

Copy-paste: preparation-only brief#

Use this for a first run of anything that could change a system. It does not replace technical permissions; pair it with Ask first rules. Our workflow brief guide has the full template.

Work only with: [approved sources].

You may read them and produce a separate draft artifact in this chat.

You may NOT: send messages, publish, purchase, delete, change permissions, accept terms, or modify the source systems.

For every change you recommend, show: exact target, current state, proposed state, reason, and how confident you are.

Finish the full analysis and draft before asking me for any decision.

If the task needs more access, name the specific missing operation. Do not widen access yourself.

Reviewing an approval: check the effect#

A convincing explanation can't fix the wrong account or destination. Compare the actual operation with the approved scope. For batches, check the count and the selection rule, not just one sample. Keep approvals narrow enough that you can later tell exactly what you authorized.

• Target account and resource are recognizable.
• The change can be inspected before it runs.
• No unrelated records slipped into scope.
• Completed changes will be reported apart from pending ones.

If something goes wrong mid-run, Stop (since 0.68.1) ends a stuck Bot within about 30 seconds and, since 0.71.2, its subagents and their pending cards. It does not undo finished actions; a Send cut off by Stop still goes out. For routines specifically, see skills vs routines.

Our take#

Treat every boundary as two halves: the words in your brief and a rule in Settings that enforces them. With Auto-review asking less after each October release, an explicit Ask first rule on sending, buying, deleting and publishing is the only reliable guarantee of a pause. Open the Permissions screen weekly, and keep cards out of Vault if you want to approve payments yourself.

Frequently asked questions#

How do I make Grok Bot always ask before sending email?#

Add an Ask first rule for sending email in Settings, which since 0.77.0 lists rules under Always Ask in the Permissions section. Ask first always stops a matching action, even if an Allow rule also matches. Keep email draft cards on as well, because since 0.75.5 a send you request in chat goes out once Auto-review allows it.

What is the difference between Ask first and Allow automatically?#

Ask first rules always stop a matching action and wait for you. Allow automatically rules let an action through only if Auto-review finds no other reason to stop it. When both match the same action, Ask first wins. Since 0.68.0 these saved rules appear as Custom Rules, and since 0.77.0 they are listed as Always Ask and Allow without Asking.

Why did my Grok Bot routine's approval expire?#

Approvals raised by routines, triggers or other Bots expire after about 30 minutes, according to Cursor's help and the official docs checked October 29, and the action then does not run. Approvals in a chat you are in wait for you. Turn on notifications for Bots that own routines instead of broadening Always allow rules.

Can a Grok Bot change my approval rules?#

It can propose changes. Since 0.75.8 on October 24, a Bot can offer to add, change or remove one of your Auto-review rules on a card you confirm. A confirmed rule is identical to one written in Settings and applies to future chats, so check the verb and target and decline anything broader than you would write.

Does Stop undo what a Grok Bot already did?#

No. Since 0.68.1, Stop ends a Bot stuck on an unresponsive step within about 30 seconds, and since 0.71.2 it also ends background subagents and expires their pending approval cards. Actions that already completed stay completed, and the release notes say a Send cut off by Stop still goes out. Check what ran after stopping.