GrokBot Tips

Sources

This is a collector page, not three full articles. Steal the rules; don’t clone the desks.

1. Ben Lang (@benln) — x.com/benln/status/2092258694352208213 (25 Aug 2026). “Collected a new list of Grok Bot pro tips shared by the @bot team.” ~1.3k bookmarks / ~49k views at capture. Sourced from @naoufal_elh, @kiaraplds, @johnbai, @shaoruu, @poteto, @pengzheng_, @leerob — Cursor / SpaceXAI people, not random Twitter lore.
2. Corey Ganim (@coreyganim) — x.com/coreyganim/status/2092284619991482842 (25 Aug 2026). Six named bots. Quotes his earlier “first Grok Bot made me $999 in 24 hours” story (speed-to-lead → Stripe).
3. John Ennis (@johnennis) — x.com/johnennis/status/2092391858257187232 (25 Aug 2026). Ghostty → coding CLIs → herdr → lantern. Follow-up: Lantern is not official — github.com/aigorahub/herdr-lantern.

Official product docs this page leans on for tip 6: Approvals, security, and privacy .

One-sentence TL;DR

Treat Grok Bot like a junior teammate with a shared laptop: give it a name and a job, don’t cron it every five minutes, block send / delete / publish until you click yes, and when it starts writing real code, hand that work to the coding CLIs instead of burning Grok Bot usage on it.

Ben’s 10 tips (the team list)

Screenshot from the tweet:

Tip 6, expanded — what “allow or deny” actually is

Ben’s wording is easy to skim past:

Set up customizable rules to allow or deny actions. For bots that are connected to X, Gmail, etc. consider blocking any write/destructive actions and have it ask for approval first.

He is not talking about a polite sentence in the system prompt. He is talking about a product setting that can stop the tool call before it runs. Prompts are a wish. Auto-review is a gate.

The two powers a connector gives you

Connecting Gmail or X does two different jobs. People mix them up.

Read is “look at my stuff.” Write is “act as me.” Destructive is “you cannot undo this from chat.” Approval does not reverse work that already completed — official docs are explicit about that. If it already sent the email, clicking Deny later does nothing.

Three fences, strongest first

Ben is pointing at fence 2, and implying fence 1 for X/Gmail. Fence 3 (tip 8, “draft only”) is backup, not the lock.

How Auto-review works

Open Settings → General → Auto-review. You add rules of two kinds:

• Require Approval — matching actions always stop for you. This is the one you want for send / publish / delete / pay.
• Always Allow — matching actions may proceed only if automated review does not find another reason to stop.

If both kinds of rule match the same action, Require Approval wins. That is the important precedence. You cannot accidentally Always-Allow a send if a Require-Approval rule also matches it.

When a stop fires:

• Desktop: Allow once (this action only), Deny (block it), Always allow (save a matching Always-Allow rule). Do not hit Always allow for send, publish, trash, or payments.
• iPhone: Approve once / Deny.

Official guidance: write narrow rules around a known action and scope. Good: “Require approval before sending any external email.” Bad: “Allow everything in the browser.” Auto-review is model-based. It complements least privilege; it does not replace it. Personal rules live on the current desktop and sync to that desktop’s Grok Bot computer — verify them again if you install on a second machine.

Starter rules (copy these, then tighten)

• Require approval before sending any external email.
• Require approval before posting, replying, or DMing on X.
• Require approval before deleting, trashing, or overwriting files / mail / posts.
• Require approval before any purchase, payment, or Stripe / checkout action.
• Require approval before changing a production dashboard or accepting legal terms.
• Always allow running git status (and other read-only inspect commands) in the project workspace — if you actually want that convenience.

Also keep the prompt boundary the docs recommend, in the same words you would use with a junior:

Reconcile the campaign data and draft a recommended change. Do not change the campaign or message the agency. Ask for approval after showing the current value, proposed value, and expected impact.

Do not approve an action whose target or effect you cannot identify. Ask the bot to explain it in plain language, or produce a draft first.

X and Gmail specifically

X. Drafts in a queue are read-adjacent. Publish is write. The Daniel Ch playbook already keeps a human on the publish button. Tip 6 is how you make that a product rule instead of a hope. A social bot that is Always-Allowed to post is a reputation incident waiting for a confused routine.

Gmail. Base Gmail access is search-and-read. Drafts, trash, labels, and send are extra scopes. Start read-only. If you need drafts, enable modify and still Require Approval on send. If a bot’s job is “watch inbound, draft a reply,” it should land in Gmail Drafts — you hit send. Corey’s Revenue Closer that “sends the Stripe link” is a write. That is the whole point of his $999 story, and it is also the blast radius: wrong lead, wrong link, sent as you.

Extra Gmail gotcha, not from Ben but from how the plugin is built: the native Gmail connection is typically one login shared across every bot on the account. Your outreach bot and your inbox cleaner both write as you. One stupid send flags the whole identity. That is why people reach for a separate bot inbox (AgentMail and similar) when the job is outbound at scale — and why Google’s TOS on automation is not a hypothetical. Don’t put a 24/7 sender on the personal Gmail.

What this is not

• Not a security boundary between bots. All of your bots share one cloud computer. Files, browser sessions, and CLI logins are visible across the roster. Separate bots are an org chart, not a sandbox. Sign out of a site when it should no longer be available.
• Not local-computer policy. That is a different toggle: Settings → General → Agent → Execution on Local Computer. Default is Ask every time. Use Never allowed unless a bot has a specific reason to touch the Mac in front of you. Peekaboo (tip 1) is why you might turn it on. Gym-class energy is why you might not.
• Not an undo button. Approval gates the proposed action. It does not rewind a send, a delete, or a charge.
• Not “the model will be careful.” Gym hack is the field example: an agent booked pilates by exploiting a booking API and cancelling a stranger’s waitlist spot. Goal-seeking without fences already happened. Tip 6 is the fence.

Corey’s six bots

Built over a weekend. The interesting part is not the count — it is that five of six watch a real inbox or calendar, and two of them send. Overlay tip 6 before you copy the desk.

Reply worth keeping: you can only run a desk like this until the usage meter hits the wall. That is the bridge to Ennis.

How this maps here: Revenue Closer ≈ ClearCafe email quarterback plus a Stripe step. Chief of Staff ≈ CEO bot. X Content ≈ social / X loop. Overwatch is the missing “back up the prompts” job most of our pages never named.

Ennis: stop using Grok Bot as the coding agent

His sequence, in order:

1. Install a real terminal on the Grok Bot computer (he uses Ghostty).
2. Install and auth the coding CLIs you already pay for (Claude Code, Codex, Grok, Cursor agent).
3. Install herdr — a herd of those CLIs in panes.
4. Install Lantern to drive herdr: herdr plugin install aigorahub/herdr-lantern.
5. Tell your Grok Bots they may only write lightweight code for conversation. Everything else: use lantern to run herdr.

Why this saves usage: Grok Bot tokens are the expensive front door. A coding CLI on the shared computer has its own quota. If the bot itself writes the patch, you pay Grok Bot to do Codex’s job. If the bot says “Lantern, open a Codex pane on this repo and implement the brief,” Grok Bot stays high-level — manager, not compiler.

Field catch if you install this on the Grok Bot computer: that machine gets wiped on a cadence. People running herdr + Tailscale on it report that only workspace files survive. Re-install Ghostty / CLIs / herdr / lantern as part of Overwatch (Corey’s backup bot), not as a one-time setup.

People were already hitting the wall. On Corey’s thread: “you can only run this stack 2 days per week because you are out of tokens.” On Ennis’s thread: “reached my weekly limit in my first 24h.” This tip is the usage valve, not a flex.

Lantern is not an official Grok Bot or herdr feature. Ennis built it. It is open source (aigorahub/herdr-lantern, plugin id aigora.lantern). It opens a chat tab that runs whatever helper CLI is on PATH (Cursor agent, Devin, Claude, Codex, or Grok) and that CLI drives herdr. Docs: aigorahub.github.io/herdr-lantern. Needs herdr 0.7.5+. Treat it like any other plugin: inspect before you let it mutate the herd.

Stack map: Grok Bot = front office. Herdr = the engineering floor. Lantern = the floor manager you talk to. Same “don’t make the front door do the specialist’s job” idea as CEO vs specialists and Eric Siu still running Hermes + Codex.

How the three posts fit

How this maps here

Related on this site

• GrokBot — platform + 100 use cases
• GrokBot CEO — Chief of Agents, already written up
• GrokBot course — official workshop; “always ask first” on outbound email
• GrokBot X — human still hits publish
• GrokBot social — one bot per brand
• GrokBot vs Hermes vs OpenClaw — keep the coding CLIs
• Gym hack — what write access looks like without a fence
• Email quarterback · Codex Fast vs Medium

Primary: @benln — 10 tips · @coreyganim — 6 bots · @johnennis — herdr / lantern · official Auto-review docs