Choose the narrowest permission mode
Ask is the default and prompts for calls not already allowed. Auto may approve calls classified as safe, while dangerous ones can still prompt. Always-approve removes most prompts but deny rules and PreToolUse hooks still apply.
Cycle modes deliberately and keep always-approve for controlled repositories and bounded tasks. A remembered allow and an explicit CLI or config allow are not equivalent for dangerous patterns.
- /auto enables Auto when the feature is available.
- /always-approve enables the broad mode.
- A deny rule wins over an allow rule.
grok --always-approveAdd explicit allow and deny policy
Use allow rules for the small set of tools or command patterns required by a task and deny rules for actions that must never run. Review the CLI help for the exact pattern your installed version accepts before automating policy.
Read, Edit, Grep, Bash, MCPTool, WebFetch, and WebSearch are documented filters. Treat git push, destructive file commands, credential access, and production mutations as separate approval boundaries.
grok --allow Read --allow Grep --deny EditConstrain approved processes with a sandbox
The sandbox is off by default. workspace is suited to ordinary development, read-only to review, and strict to untrusted repositories; custom profiles can add path and network restrictions.
On Linux, read-only and strict can block child-process network access. The official documentation says that child-network restriction is a no-op on macOS, while in-process model and web-tool traffic is outside that setting. Also protect sensitive paths explicitly because built-in profiles do not permanently shield credentials such as ~/.ssh.
- Pair strict with narrow permissions for untrusted code.
- Remember that ~/.grok remains writable for session persistence.
- Test the effective policy on every target operating system.
grok --sandbox workspace
grok --sandbox read-only
grok --sandbox strict