What will Grok Bot send by itself, and what still waits for a tap on the phone?

Grok Bot will keep working without you, and it will send or change things when no rule stops it. What waits for a tap is an action you bounded, an ask-first rule, a site that wants a human, or a password. The phone shows the same approval controls as the desktop: Allow once, Always allow, and Deny. A lock screen does not tap them. A draft waits because you asked for a draft or because a rule requires approval, not because every outbound message is frozen by default.

That split is the approvals page, not the launch quotes about trusting a Bot forever. The product is built to finish work on a cloud computer while you are away. Approvals, secure handoffs, and explicit boundaries are how you keep the consequential part in your hands. If you never wrote a boundary, do not expect the phone to invent one.

What can proceed while the phone is in your pocket?

A background turn and a routine. Closing the app, the laptop, or the phone does not stop them. On the shared cloud computer the Bot can use the browser, files, and connectors it already has. Auto Review, when it is on, evaluates tool calls and computer actions before they run. An allow-automatically rule lets a matching action proceed only when that review does not find another reason to stop. A narrow example the docs give is allowing git status inside /workspace/reports. That kind of read can happen with no tap.

Preparation is what the routines page tells you to automate: draft, reconcile, recommend. A watch list posted in the Bot’s own conversation is a message to you, inside the product, and the sample routine asks for that on a schedule. It is not the same as emailing a customer. Internal progress in the Grok Bot chat can show up without you unlocking. External delivery is the line the docs keep drawing.

Auto Review does not see every side effect. The security FAQ says it does not review memory writes and most settings changes. A Bot can update what it remembers, or change a setting outside the reviewed set, without a card on your phone. That is a reason to read the conversation when you return, not a reason to assume the phone is a complete audit log.

What is supposed to wait for you?

The approvals page lists the actions that deserve an explicit stop: sending messages or invitations, publishing, purchases and transfers, deleting or overwriting data, changing permissions, production changes, and accepting legal terms. The routines page uses a shorter version of the same list: sending, purchasing, deleting, publishing, or changing production systems. You put the stop in the request. The sample is to reconcile data and draft a budget change, and not to change the campaign or message the agency, and to ask for approval after showing the current value, the proposed value, and the impact.

When an action needs approval, the conversation shows the proposed operation and its inputs. You review the target, the scope, and the values. Allow once lets that action continue. Always allow can save a matching rule. Deny blocks it. The docs say those controls are the same on iPhone. An approval does not reverse work already completed. If the Bot already changed a file or sent something that was not behind the gate, the tap you missed cannot unsend it. That is why the boundary has to exist before the run, not as a feeling you check in the morning.

Ask-first rules always stop a match, even if an allow-automatically rule also matches. Ask first wins. You add them under Settings, then General, then Auto-review. The docs’ own narrow rules are “ask first before sending any external email” and “ask first before changing a production dashboard.” A broad rule such as allowing everything in the browser is called out as a mistake, because sites change and Auto Review is model-based. It complements least privilege. It does not replace it. If a team admin enforces Auto Review, locked team rules appear in that table and you cannot edit them. Your rules can only make behavior stricter.

Personal Auto-review rules are stored on the current desktop and synced to its Grok Bot computer. Another desktop install needs its own. A phone does not become a second rule editor that overrides a desktop you have not set up. If you only use the phone, confirm the rules exist on an install that actually synced, or do not assume the ask-first email rule is live.

What about passwords and the sites that will not let a Bot through?

Passwords, passkeys, two-factor codes, CAPTCHAs, and payment confirmations are handed to you. The documented path is to open Agent Computer, take control, complete the step, return control, and tell the Bot to continue. Do not send a password or a one-time code in ordinary chat. If the Bot shows a secure secret request for a supported connection, you type into that request. It is masked, excluded from the transcript, and not shown to the model. It is not a general password manager.

A normal web form is a lighter version of the same pause. When a page needs a login, a checkout address, or a phone number, the Bot can show one form per step in the chat and fill your answers into the page. Those forms wait. The cloud computer does not invent the address. A hardware security key, such as a YubiKey, can be used from a key plugged into your desktop while Use hardware security keys is on under Settings, then General, then Security Key. That setting is on by default on macOS and Windows, is not yet supported on Linux, and every use asks you to approve it first. The phone lock is irrelevant to a key that is plugged into a desktop. The tap, or the key touch, is still yours.

A site that blocks automation, expires a session, or says a human is required is a stop, not a puzzle for the Bot to route around. The FAQ says the Bot hands those steps back. I am not going to describe how to defeat a check. The waiting is the correct behavior. Your tap, or your taking control, is the continuation.

What about the computer on your desk?

The cloud computer and your Mac or Windows machine are different grants. Cloud work does not need the local setting. Local execution defaults to ask every time. The choices are ask every time, always allow, or never allow, under Settings, then General, then Bot, then Execution on Local Computer. After computers are registered, each machine has its own switch under Settings, then Computer, then Computers. The first prompt in the conversation reads: allow Grok Bot and all Bots to run commands on your local computer, with Always allow, Allow once, Never, and Deny once. Always allow and Never apply to every Bot. A stricter team ceiling removes Always allow. None of this stops the cloud computer. A tap on the phone can answer that local prompt if the conversation is in front of you. It cannot answer it while the phone is locked, and the cloud task that did not need your disk keeps going.

How do you make “send” mean “draft” on purpose?

Say it in the task, and put the same sentence in the skill or routine if the job will recur. A demonstration does not replace the written approval boundary. If the recording included a click on Send, edit that out of the draft skill before you schedule it. Confirm the routine’s approval line when the Bot shows the next run. Test runs perform real work, including connected tools, so a test is the wrong place to discover that email was not gated.

Then add the ask-first rule for external email if that is the action you care about. The sentence in the chat and the rule in Auto-review are both yours to write. Neither appears because you use a phone. When you return, look at what already happened. Approval will not roll it back. Pause the routine if the source or the expected workflow changed. A Bot can own up to 50 routines, and after a long absence Grok Bot may ask whether to keep them running and pause them if you do not answer. A paused routine is a stop you can see. A sent message is not.

Grok Bot will do the unattended preparation, and it will take an allow-automatically action that review does not block. It waits for a tap when you required approval, when an ask-first rule matches, when a password or a human check is in the way, or when it wants your local computer and the default ask is still on. The phone is where those taps are the same three controls as on the desktop. Unlock it, read the target, then choose. A dark screen is not a decision. It is not a guarantee that nothing left the building while the screen was dark.