Auto Review: Ask first vs Allow automatically

The last lesson said "pre-authorize safe actions." Here is the mechanism. With Auto Review on, Grok Bot evaluates tool calls and computer actions before they run, against rules you set under Settings → General → Auto-review. There are two kinds:

• Ask first rules always stop a matching action and wait for you.
• Allow automatically rules let a matching action proceed — but only when the automated review doesn't find some other reason to stop it.

And the tiebreaker that makes the whole system safe: if both kinds of rule match the same action, "Ask first" wins. That means you can be generous with "Allow automatically" for routine work and still draw hard lines with "Ask first" that override everything. One rule like "Ask first before sending any external email" reliably stops that entire class of action, no matter what else you've allowed.

The craft is writing rules narrow — around a known action and a known scope. The docs give the shape:

• Ask first before sending any external email.
• Ask first before changing a production dashboard.
• Allow automatically when running git status in /workspace/reports.

Notice the allow rule names both a specific command and a specific place. That's the pattern: allow a precise, safe, reversible thing in a precise location. The docs warn explicitly against the opposite — broad rules like "allow everything in the browser" — because websites and tools change over time, so a rule that trusts a whole surface will eventually auto-approve something you'd never have approved by hand. Auto Review is model-based judgment; it should complement least privilege and explicit boundaries, not replace them.

Two practical notes. First, on a team, an admin can enforce Auto Review rules you can't edit or delete; your own rules sit on top and can only make things stricter, never looser. Second, personal Auto-review rules live on the desktop where you made them — another machine needs its own. So don't assume a rule you set on your laptop is protecting a routine running from a different install.

Put the two lessons together and you have the overnight recipe: narrow Allow automatically rules for the safe, repetitive actions so routines finish on their own; firm Ask first rules on everything risky so the dangerous actions always stop for a human — even if some other rule would have let them through.