METAGROK
BUILD / configure-grok-build-permissions

Configure Grok Build permissions for tool approvals

configure-grok-build-permissions

Permissions decide which tool calls may run. Sandbox limits what an approved call can do on the filesystem and network — configure that separately in Enable the Grok Build sandbox.

Modes

Mode Behavior Enter via
Ask (default) Prompt for anything not already allowed —
Auto Classifier auto-approves safe tools; dangerous ones may still prompt (deny rules and hooks still apply) /auto, Shift+Tab when the feature is on
Always-approve Auto-approve tool calls (deny rules and PreToolUse hooks still apply) /always-approve, Ctrl+O, Shift+Tab, grok --always-approve

Shift+Tab cycles Normal → Plan → Auto (when available) → Always-approve. /auto appears only when the auto permission-mode feature is enabled. Running /auto while always-approve is on (or the reverse) switches modes; the modes do not stack. Status shows auto when auto is active and plan mode is not.

Set a default in user config

Put the default in ~/.grok/config.toml or managed requirements — project .grok/config.toml does not hold this key:

[ui]
permission_mode = "auto" # or "ask" | "always-approve"

Legacy keys approval_mode and yolo = true still work. When more than one is set, permission_mode wins.

Allow and deny rules

[permission]
rules = [
  { action = "allow", tool = "bash", pattern = "git *" },
  { action = "allow", tool = "read" },
  { action = "deny",  tool = "bash", pattern = "rm -rf *" },
]

--allow / --deny take the same patterns per invocation. Supported filters include Bash, Edit, Read, Grep, MCPTool, WebFetch, and WebSearch. A deny rule always wins over allow.

A remembered “always allow” grant still prompts for dangerous patterns such as rm and git push. An explicit config or CLI allow rule auto-approves them. Under always-approve they run unless you add a deny.

Plan mode stays independent

While planning, edit tools stay limited. The plan review UI still opens under auto or always-approve — see Use Plan Mode. Headless modes such as dontAsk and locking always-approve off are covered under Enterprise Deployments in the official docs.

Pitfalls