Approvals, security, and privacy

Grok Bot is designed to complete work while keeping sensitive inputs and consequential actions under your control. Use approvals, secure handoffs, and clear Bot boundaries together.

Tell the Bot which actions it can take and where it must stop:

Reconcile the campaign data and draft a recommended budget change. Do not change the campaign or message the agency. Ask for approval after showing the current value, proposed value, and expected impact.

Prefer explicit boundaries for:

• sending messages or invitations;
• publishing content;
• purchases and financial transfers;
• deleting or overwriting data;
• changing permissions;
• production changes; and
• accepting legal terms.

An approval controls the proposed action. It does not reverse work already completed.

When an action needs approval, the conversation shows the proposed operation and its inputs. Review the target, scope, and values before approving.

• On desktop, Allow once lets the Bot continue with that action and Deny blocks it. Always allow can save a matching rule.
• On iPhone, the equivalent controls are Approve once and Deny.

Do not approve an action whose target or effect you cannot identify. Ask the Bot to explain it in plain language or produce a draft first.

When Auto Review enforcement is available, Grok Bot evaluates tool calls and computer actions before they run. Open Settings → General → Auto-review to add rules.

• Require Approval rules always stop matching actions for you.
• Always Allow rules let matching actions proceed only when the automated review does not identify another reason to stop.
• If both kinds of rule match, Require Approval wins.

Write narrow rules around a known action and scope:

• Require approval before sending any external email.
• Require approval before changing a production dashboard.
• Always allow running git status in /workspace/reports.

Avoid broad rules such as “allow everything in the browser.” Websites and tool behavior change over time. Auto Review is model-based and should complement, not replace, least privilege and explicit approval boundaries.

Personal Auto-review rules are stored on the current desktop and synced to its Grok Bot computer. Verify them separately on another desktop installation.

For passwords, passkeys, two-factor codes, CAPTCHAs, and payment confirmations, the Bot should hand you control of the computer.

1. Open Agent Computer.
2. Take control.
3. Complete the sensitive step.
4. Return control and tell the Bot to continue.

Do not send a password or one-time code in ordinary chat.

If the Bot presents a secure secret request for a supported connection, enter the value in that request. It is not a general-purpose password manager. The value is masked, excluded from the transcript, and not shown to the model.

The shared Grok Bot computer runs in the cloud. Access to the Mac or Windows computer in front of you is a separate capability.

In Settings → General → Agent → Execution on Local Computer, choose whether local commands:

• always require approval;
• are always allowed; or
• are never allowed.

The default is Ask every time. Use Never allowed unless a Bot has a specific reason to work on your local files. These settings do not prevent the Bot from using its cloud computer.

All of your Bots share one cloud computer assigned to your user account. Files, browser sessions, and command line credentials on that computer are available across your Bot roster.

• Do not use separate Bots as a security boundary.
• Sign out of a service when it should no longer be available.
• Remove sensitive temporary files after the work is complete.
• Delete a connector or revoke its authorization in the source service when access is no longer needed.

Do not treat this user assignment as a guarantee that is broader than Cursor's published security documentation. Review current infrastructure and encryption controls there.

Grok Bot uses Cursor authentication and account data settings.

• Grok Bot requires data storage and does not support Legacy Privacy Mode.
• Privacy and data-sharing choices are managed through Cursor account settings and, when required, the Grok Bot access flow.
• Training opt-out follows the applicable Cursor account and privacy settings.
• Review the current Cursor Privacy Policy and security information for contractual details.

Organization administrators can restrict local-computer execution and may provide managed setup for the cloud computer. Available controls depend on the organization's rollout and plan.

When a project or login should no longer be available:

1. Pause or delete related routines.
2. Sign out of websites on the shared computer.
3. Uninstall connectors and revoke their authorization in the source service.
4. Remove sensitive project files from /workspace.
5. Hide or delete Bots that should no longer appear in Grok Bot.
6. Use the account settings flow if you need to delete the Cursor account.

Deleting a Bot does not remove shared-computer files or browser sessions. Backend retention and account deletion follow the applicable Cursor terms.

• Connect only the tools a workflow needs.
• Use scoped service accounts where the source system supports them.
• Start with read-only tasks and draft outputs.
• Keep sending, publishing, purchasing, deletion, and production changes behind approval.
• Review installed connectors and active routines regularly.
• Pause a routine when its source system or expected workflow changes.
• Preserve source links and an action log for important decisions.