Which product and account does this cover?
Grok Bot, connected apps, the shared cloud computer, and optional local execution.
- Personal Grok Bot
- Access includes Premium/Super/Ultra on The X Subscription and eligible legacy Cursor plans or linked accounts; account and rollout determine availability.
- Teams and Enterprise
- Admin controls vary. Network Controls and enforced organization Auto Review are Enterprise features; do not assume self-serve Teams includes them.
- Local commands
- Optional desktop execution, controlled separately for each signed-in desktop. Cloud work does not require this permission.
What the permission settings mean
Connect the smallest useful source
Open Connect apps, add the service, and complete Authorize or Authenticate. Installed does not mean connected. Confirm the provider identity; source-system Viewer access is a useful starting boundary.
Review exposed app tools and disable unwanted actions where offered. A connection applies across your Bots. Do not put confidential files in a second Bot and assume the first cannot reach them: all Bots share the account's cloud computer, files, and browser sessions.
Keep Auto Review on and add narrow Ask first rules
Under Custom Rules, describe sending email or sharing a document and choose Ask first. Add rules for publishing, deleting, or recurring work as needed. Ask first wins conflicts.
Inspect the proposed target and change. Allow once approves that action; Always allow can save a future rule. Deny stops the proposed action. Auto Review is model-based: it can approve without a human.
Review the computer and browser too
Keep local execution on Ask every time, or Never allow when unnecessary. The setting applies to that desktop; it does not remove access already available in the cloud.
An app block does not block the same service's website. Sign out of unnecessary browser sessions and inspect the cloud computer's contents. Enterprise network restrictions are separate controls; their allowlist does not cover remote MCP connections unless Apply to MCP servers is enabled.
Separate memory, training, and stored files
Ask “What do you remember about me?” and correct or ask it to forget an unwanted fact. Grok Bot currently has no personal memory-management screen. Resetting a conversation retains memory, files, routines, and settings.
Training choices follow the applicable Cursor account and privacy settings; they are not the same as Bot memory. Grok Bot requires cloud storage and does not support Legacy Privacy Mode. Do not interpret a training opt-out as no stored task data.
Inspect activity and stop every remaining route
Inspect conversation tool steps and open the computer if behavior is unclear. Send “Stop now” and check whether work stopped. Closing the app does not stop cloud work.
Open Bot name → Details → Routines to pause or delete recurring work; inspect its run history. Then remove unneeded apps, revoke the service's authorization, and sign out of browser sessions. Deleting a Bot removes its own records and routines, but does not clear shared computer files or logins. Stopping a task does not undo changes already made.
Practice with fictional material
Prove one read path and keep the reply unsent
Use harmless A and B documents with unique markers. Give the connected identity Viewer access to A and no access to B. Keep B off the shared computer and out of other connections, browser sessions, and memory.
- Keep Auto Review on. Add Ask first rules for sends, shares, edits, and routines. Disable write tools where offered; keep local execution unavailable for this test.
- Ask for A's marker and source, then request B's marker without revealing it. Do not approve broader access.
- Ask: “Write the reply in this conversation only. Do not create an email draft, send, edit, share, or schedule anything.” Deny any such proposed action.
- Inspect tool steps and the actual source history, Drafts, Sent, and routines. Do not rely solely on the Bot saying it made no changes.
Check the evidence
- A is correctly sourced and B is inaccessible.
- The draft exists only in the conversation; provider state is unchanged.
- For a later revocation test, add a fresh harmless fact after disconnecting. Old remembered information does not prove current access.
Common questions
Is telling the Bot “draft only” enough?
It states intent without removing app, browser, or command capabilities. Pair it with source permissions and tool restrictions.
Is a new Bot a separate security boundary?
No. Bots share the cloud computer and its logins. Use separate source permissions and account boundaries when isolation matters.
Official sources
These instructions were checked against product documentation on October 31, 2026. The practice exercise is a suggested test for your own permitted workspace, not a claim that these controls were configured in your account.
Keep the whole workflow in view.
Set permissions for the tools you use.
Start with the overview, then follow the guide for your assistant or connection. Check what it can read, what it can change, and where approval happens.
Read the Controls overview