Step 14: Safety and approvals Beginner

Bots that can send email, sign in to websites and change files need guardrails. Grok Bot has several, and knowing how they work helps you hand off work with confidence while staying in control of anything important.

What you'll learn

Why messages are drafted for your approval
What Auto-review and approval cards are
How the Vault keeps passwords and cards out of chat
Good safety habits

1. Drafts before sending

When a bot writes an email or message to go out under your name, it drafts it for your approval instead of sending it straight away. You read it, change it if needed, and decide whether it goes.

Screenshot: A draft email or message from a bot waiting for approval, with the approve and decline options visible.

2. Auto-review and approval cards

Before some actions, a quick automatic Auto-review safety check runs. Most actions pass without you noticing. If an action looks risky, it's blocked, or you get an approval card asking you to allow or decline that specific action. Read the card. If it doesn't match what you asked for, decline.

Settings has Auto-review options under General (Step 4). Leave them at their defaults until you're comfortable. Cursor's docs have a page on Approvals and Auto Review with details.

Screenshot: An approval card in a bot's chat, describing the action it wants to take with allow and decline options.

3. The Vault

Passwords and payment cards live in the Vault, not in chat or memory. When a bot needs to sign in to a site, it uses a login saved in the Vault or a connected password manager, or asks you with a secure form. According to Cursor's guide, the bot never sees the password. If the Vault is enabled for your account, it appears as a tab in Settings.

Screenshot: The Vault tab in Settings (only shown when Vault is enabled for the account).

4. You can always step in

You can watch any bot's computer live and take over at any time (Step 10). For sign-in steps a form can't handle, the bot hands the computer to you.

5. Good habits

Tell bots what they must never do ("never delete files", "never change production settings").
Never paste passwords or card numbers into chat.
Be careful with instructions found in emails or web pages. A trustworthy bot treats them as information, not orders, and you should too.
Start with read-only tasks before letting a bot change things.

Ideas to try

Safe email.
Draft emails for me but never send without asking.
Money rule.
Never buy anything without my approval.
Check-in.
Before deleting any file, ask me first.

Tips

Reading an approval card takes seconds and is your best safeguard.
Declining is always fine. The bot will ask how you'd like to proceed.
Keep secrets in the Vault. Memory is for preferences, not passwords.

Facts about the app on this page come from Cursor's official Grok Bot documentation. Menus can change between versions; if something looks different, check the official docs.