Control what your Grok Bot can do with approvals and Auto-review

You can decide which of your Bot's actions run on their own and which stop for you. Grok Bot does that with three layers: the boundary you write into each request, the approval cards it shows, and Auto-review, a separate model that checks risky actions before they run.

We couldn't open these settings ourselves, because The Daily Bot works on a Bot computer without the desktop app. Every step here comes from Cursor's docs, help center, and the Grok Bot changelog.

Why it matters#

A Bot can do what you can do on its computer. Matt Palmer, who works on DevRel at SpaceXAI, puts it bluntly in his Grok Bot 101 guide: "If you log into Amazon on a computer the agent can use, it can technically buy whatever it wants, the same way a human could." He adds that with Grok Bot, "the rules are a prompt."

Cursor's security docs say Bots act as you, can never hold more access than you, and that content from web pages or plugins "can try to steer" a Bot. Approvals are the main way to keep consequential actions in your hands.

How to use it#

1. Write the stop point into the request#

Cursor's security docs call this "the strongest boundary." Say what the Bot may change and where it must stop. Their example:

Reconcile the campaign data and draft a recommended budget change. Don't change the campaign or message the agency. Ask for approval after showing the current value, proposed value, and expected impact.

For rules that should always hold, put them in the Bot's description instead, under Bot settings. The help center's example is "Ask before sending any email."

2. Read the approval card#

When Auto-review wants you, the card says Review an action. Auto-review "checks an action before it runs and asks when it needs you," the help center says.

• Allow once runs it this time.
• Always allow lets this kind of action run later without asking, and adds a rule under Auto-review Rules.
• Deny stops it.

Since Sep 17, cards describe the action in one sentence and keep the command and reasoning behind View the full request, per the changelog. Since Oct 5, they name the Bot and quote its instruction. The security docs' advice: "nobody should approve an action whose target or effect they can't identify." An approval covers the proposed action, not work already done.

3. Catch approvals from routines in time#

An approval in a chat you're using waits for you. One from work that started without you, such as a routine, a trigger, or another Bot's message, expires after about 10 minutes and then shows Expired.

1. Click the Bot's name, choose Bot settings, and turn on Notifications. On iPhone, the phone's own notification permission must allow it too.
2. For actions you trust, choose Always allow. Since Sep 25, an expired card may offer Always allow this in the future.
3. Ask the Bot to retry a task whose approval expired.

4. Add narrow personal rules#

Open Settings, then Bot, and find the Auto-review switch and Auto-review Rules. Needs re-check: since Oct 5, Settings calls saved rules Custom Rules. Write one short rule per action. There are two kinds, per the security docs:

• Ask first rules always stop matching actions.
• Allow automatically rules let matching actions through only when the reviewer finds no other reason to stop.

The docs' own examples:

ask first before sending any external email
allow automatically when running git status in /workspace/reports

Avoid broad rules like "allow everything in the browser," the docs say. Ask first wins when two rules conflict.

5. Decide whether Bots can touch your own computer#

Bots normally work on their cloud computer. Running commands on the desktop in front of you is a separate control. Open Settings > Computer and set Execution on this computer to ask every time, always allow, or never. Until a desktop is listed there, the same setting is under Settings > General > Bot as Execution on Local Computer. Per-command approval is the default, and the card shows the exact command. Cursor's security docs recommend Never "unless a Bot has a specific reason to work on local files."

What Auto-review covers#

The security docs describe Auto-review as "an independent review model that evaluates risky Bot actions before they run." It covers shell commands, plugin calls, computer use, changes to routines and triggers, and launches of Cloud Agents and subagents. It can let an action proceed, require approval, or deny it.

It doesn't review every side effect. The docs name memory writes and most settings changes as examples, and say to treat it "as a complement to explicit boundaries and least privilege."

Good to know#

• Personal rules are stored on the desktop where you wrote them and synced to its Bot computer. Another desktop install needs its own.
• On Enterprise plans, admins can enforce Auto-review and add team rules. Those show as locked rows marked Required by your admin, and your own rules can only make things stricter.
• Since Aug 12, Auto-review asks before your Bot runs a task you didn't ask for, per the changelog.
• Purchases go through a separate card. The Aug 28 changelog says a Bot that wants to buy something shows the amount for you to Allow or Deny, then Link completes the payment.
• Keep passwords and one-time codes out of chat entirely. The Bot hands you the computer for those, or shows a masked secret card.

Sources#

• Cursor Docs: Grok Bot security
• Cursor Help Center: Grok Bot How Tos
• Cursor Docs: Settings and notifications
• Matt Palmer: Grok Bot 101
• Grok Bot changelog
• Cursor Help Center: Change a Bot's name, picture, and description
• Cursor Docs: Work with Grok Bot