Auto Review and approval cards: how Grok Bot asks first

Grok Bot doesn't ask you about every click; it would be unusable if it did. It asks about the actions that matter, and you decide which ones those are. Here is how that works.

What Auto Review does

Auto Review is on by default. The Grok Bot 101 guide describes the design: rules are written in natural language, and “a separate review agent checks proposed actions and can allow, block, or escalate to you.” It's model-based, so the docs say it “should complement, not replace, least privilege and explicit approval boundaries.”

One detail protects you from a common attack: Auto Review takes into account what you asked for in your own messages, and “text from somewhere else, such as an email or a web page, doesn't count as your request.”

The buttons on an approval card

The card shows the proposed operation and its inputs. Review the target, scope and values, then:

• Allow once: the Bot does it now. No rule is saved.
• Always allow: the Bot does it now and saves an Allow rule to your Custom Rules (the card shows Saved to Custom Rules).
• Deny: the Bot doesn't do it, and won't try that action again or ask about it until you send another message.

Some cards use other labels. A terminal-command card shows Allow and Skip; a card paused by an Ask first rule shows Allow and Not now. Some carry warnings such as This can't be undone or This shares your data outside this chat. Read those twice.

Why cards expire

Sending a new message instead of answering also closes any open card in that chat. For Bots that run routines, the troubleshooting guide suggests turning on Notifications, choosing Always allow for actions you trust, and asking the Bot to retry after an expiry.

Custom Rules

Rules live in Settings → General → Bot, under the Auto-review switch. To add one, describe one action in plain words under When Grok Bot wants to:, choose Allow automatically or Ask first, and press Add Rule.

• Ask first rules always stop matching actions for you.
• Allow automatically rules let matching actions proceed only when the automated review finds no other reason to stop.
• If both match, Ask first wins.
• You can have up to 20 of each, up to 1,000 characters per rule. At 20 Allow rules, a new Always allow removes your oldest one and tells you which.

Built-in safety checks apply whatever your rules say. On a team, admin rules show Required by your admin and your own rules can only make behavior stricter.

Rules that hold up

xAI's examples are short and specific: “Ask first before sending any external email.” “Ask first before changing a production dashboard.” “Allow automatically when running git status in /workspace/reports.” The one to avoid: “allow everything in the browser.”

Email and messages

Bots draft outgoing email and Slack messages for your review by default. Email you ask for in chat goes out once Auto Review allows it. Email from a routine, an incoming message or other work you didn't request waits as a draft until you press Send, and a forward, or an email with an attachment Auto Review can't fully read, always waits for your OK.

Shared Bots and group chats

On a shared Bot, each teammate answers cards for their own requests. In a Slack thread only the person who asked can answer, and in a group chat only the person whose message the Bot is answering can approve; group chat cards don't offer Always allow.

If you're deciding how much to trust a bot from the directory, our permission levels give you a quick read before you add it.