Grok Build review, rollback, and safety rails

Build #4482 goes red at 01:14. The workflow file is cleanup.yml. The line that mattered was grok -p "remove unused files from this workspace". The agent deleted .env.staging. That file was gitignored, so git history cannot give it back. Six values now live only in a 1Password vault someone has to open at 1:20 a.m. The next job cannot talk to staging. Nobody “approved” a delete. Headless mode does not hover.

This is Part 20 of the Grok series, the last Grok Build chapter before Imagine. Parts 16 to 19 got you a sandbox, a loop, a thin tool list, and a suspicious workbook. This part is the boring rails: how much the agent may do alone, how a bad diff smells, how to roll back, and what never belongs in a grok -p prompt. If Build vs chat is still fuzzy, keep the four surfaces open.

Permission labels move. Re-check the Build overview the week you put grok on a runner. SuperGrok and X Premium Plus were the May 2026 launch audience. A paid seat is not a permit to point headless Build at production secrets.

Autonomy in plain English: watch, auto, always-approve

• Autonomy in plain English: watch, auto, always-approve, and headless grok -p
• Diff smells that mean you stop merging, even if the TUI sounds sure
• Git as the real undo, including files git never saw
• How secrets and prod folders get eaten by vague cleanup prompts
• Runaway loops, plus a short team list you can paste into AGENTS.md

Autonomy levels

Think in four heights, not in vendor poetry. The TUI still uses names like ask, auto, and always-approve. Shift+Tab cycles modes. You can start hot with a flag. The idea is the same on every label set: who says yes before a tool runs.

• Watch / ask. You see the command or the file write and you allow it. Default for any folder you care about.
• Auto. A classifier lets boring tools through and may still stop on dangerous ones. Fine after you trust this repo and the prompt is narrow.
• Always-approve. Skips permission prompts. Deny rules and hooks can still block some things. This is how 01:14 happens while you sleep, if you also remove the human.
• Headless grok -p. One prompt, no TUI, built for scripts. Useful after the prompt has survived a watched session. Fatal when the prompt is a vibe (“clean unused files”).

Plan mode sits beside these heights. It holds ordinary file edits until you accept a plan. Use it. It does not save you if you then paste the same vague cleanup into CI with always-approve. The file-edit gate is for the session you are looking at. A runner is a different session with no eyes.

A safe promotion path: watch a task three times in the TUI. Tighten the prompt until git diff is one path. Only then consider grok -p with that exact prompt, on a throwaway job, with secrets not on disk. Skipping from first install to a nightly cleanup is how build 4482 earned its number.

Grok build review rollback safety

Open the diff yourself. The TUI summary is marketing for the patch. git status and git diff are the patch.

git status
git diff
git diff --stat

Stop if you see any of these, even when the headline change looks right.

A 14-file date fix (Part 17) and a six-tab workbook (Part 19) both fail this table. So does a “cleanup” that removes gitignored secrets. The smell is the extra blast radius, not the author’s tone in the TUI.

Rollback is git

Grok Build can rewind a conversation in the TUI. That is handy for chat clutter. It is not a backup of the disk. Files the agent deleted, especially files git was told to ignore, do not come back with a rewind. Git is the undo for tracked files. Your secret manager is the undo for .env.staging.

Before a session you think might edit more than one file:

git status
git add -A
git commit -m "pre-agent restore point"

If you cannot commit (dirty WIP you do not want in history), stash or make a branch. The point is a restore target with a name. After the agent runs:

git status
git diff --stat
git restore exports/csv_writer.py
git restore .

git restore path throws away uncommitted edits on that path. git restore . throws away uncommitted edits in the whole work tree. Use the narrow form first. The wide form is for “this session is junk.” Neither form restores a file that was never tracked. That is why .env.staging died at 01:14. git status never listed it as a tracked change. It only vanished from disk.

If you already committed a bad agent patch:

git log --oneline -5
git revert HEAD

Revert if the commit already left your laptop. Reset only if you know the commit is local and you are allowed to rewrite. Do not reset a shared branch because an agent got messy. Revert is the teammate-safe story.

Worktrees (Part 18) help isolate an experiment. They do not replace the restore point on the branch you will merge. If a subagent commits in a worktree, review that commit like any other human PR. Parallel does not mean pre-approved.

Secrets and prod

Two rules, both dull, both broken in build 4482.

Do not start grok in a directory that holds production clones, live credentials, or customer exports. Part 16 used a 2.1 GB Desktop folder as the bad example. CI home directories are the same trap with a nicer name. If the runner checks out the repo and also injects a dotenv file onto disk, the agent can see it. If the prompt says “unused,” a dotenv file looks unused. It is not imported by the app you are linting. It is still the only copy of six values.

Do not put cleanup language in headless prompts. “Remove unused files,” “tidy the workspace,” “delete leftovers,” “reset the folder” are delete spells. Name the path. Name the glob. If you cannot name it, you are not ready for grok -p.

Safer CI shape, if you must automate later:

# Not a cleanup. A named, read-mostly job.
grok -p "List test files under tests/ that do not import any module. Do not delete. Write the list to /tmp/orphan-tests.txt and stop."

Even that job should run without env files on disk. Pass secrets as runner env that the tool cannot rewrite, or do not pass them into the agent job at all. Rotate anything an agent may have printed. If .env.staging was deleted, assume it was also read. Change the six values after you restore them.

Production deploys are out of scope for a first-month Build setup. Do not let the agent push, apply terraform, or migrate a database because the TUI offered a command and you were in always-approve. Type those yourself, after review, on the path your company already uses.

Grok build review rollback safety (safety)

Agents retry. A test fails, they edit, the test fails a different way, they edit again. Headless mode plus a vague success condition is a loop with a cloud bill. You will notice when the runner hits a time cap, or when git log shows twelve “fix tests” commits in nine minutes.

Give every automated prompt a stop line. “If tests fail twice, write the failure to agent-fail.txt and stop.” “Do not retry more than once.” “Do not commit.” If the product grows a /loop or scheduled-task feature, treat it like CI: named prompt, named folder, no secrets, a human reading the first three runs.

Context bloat is a quieter loop. A session that started as “explain this file” picks up a workbook, then a plugin, then a browser. /compact and a fresh /new session are cheaper than letting the agent “finish” a four-hour thread. When the job changes, start a new session. Part 14 said that for chat. Build needs it more, because leftover goals still have a shell.

Grok build review rollback safety 3

Write the rails down so the next person does not invent 4483. Put them in AGENTS.md and in the team wiki. Short enough to read.

# AGENTS.md (safety stub)

## Autonomy
- Default to watch/ask in the TUI.
- No always-approve on repos that contain env files or customer data.
- No `grok -p` until the same prompt produced a one-path diff in a watched session.

## Secrets
- Do not read, print, or delete `.env*` or key files.
- If a secret might have been read, say so and stop.

## Git
- Do not commit, push, or open PRs unless I ask.
- Leave a restore point before multi-file work.

## CI
- Forbidden prompts: clean, tidy, remove unused, reset workspace.
- Allowed automated jobs must name paths and forbid deletes.

Add grok inspect to onboarding. If a laptop already has nine MCP servers (Part 18), inspect will show them before the first ticket. Pair that with the sandbox rule from Part 16. New hires run first session in a toy folder, not in the staging checkout that happens to sit on the Desktop.

Feedback to xAI belongs in the TUI (/feedback on the launch post). Feedback to your team belongs in the incident note for 4482: prompt text, autonomy level, what file died, whether it was tracked, who restored secrets. That note will teach more than a slogan about “responsible AI.”

Watch first. Promote a prompt to grok -p

Watch first. Promote a prompt to grok -p (safety)

In the sandbox, make a tracked README and an untracked .env.toy with fake values. Commit the README. Run a watched session with a sloppy prompt on purpose: “clean unused files.” See what the agent reaches for. Deny it. Then run the named prompt that only lists orphans. Restore anything that slipped. If you already have a CI idea, write the prompt on paper and put three forbids in it before anyone pastes it into YAML.

Next in this series is Imagine: text to image, then edits, video, and rights. Build stays the folder agent. Imagine is the studio. Do not generate a “professional cover” for the vendor deck until you have read that part. Index: Grok series. The first Imagine title is Grok Imagine: text to image from zero.

Watch first. Promote a prompt to grok -p 3

• Watch first. Promote a prompt to grok -p only after a one-path diff
• Read git status and git diff. Extra files are a stop, not a style note
• Rollback for tracked files is git. Rollback for .env is the vault
• Never headless-cleanup a workspace that can see secrets or prod clones
• Stop loops after two failures. Write the rails in AGENTS.md

Sources

Research and further reading used for this article:

• xAI docs: Grok Build overview (TUI, headless grok -p, config, inspect)
• xAI: Introducing Grok Build (plan/review/approve, subagents, /feedback, May 2026 eligibility)
• xAI: Grok Build (install and product home)
• xAI docs: Grok 4.6 (model behind Build as of writing)
• xAI Console (API keys; separate from chat subscription money)
• xAI: Grok FAQ (plan questions to re-check)
• Analytics Made Simple: Learn (related paths on this site)

Merch on Etsy

Open store →

Naive Bayes Mouse Pad, Data Science Mouse Pad, Analytics Mouse Pad, Bayesian Mouse Pad View on Etsy → Y Hat Mouse Pad, Data Science Mouse Pad, Analytics Mouse Pad, Y Pred Mouse Pad View on Etsy → You're On Mute White Ceramic Coffee Mug, Data Science Mug, Data Mug, Analytics Mug, Statistics Mug, Programming Mug, Gift Mug, Coffee Mug View on Etsy → You're On Mute White Ceramic Coffee Mug, Data Science Mug, Data Mug, Analytics Mug, Statistics Mug, Programming Mug, Gift Mug, Coffee Mug View on Etsy →