Sign in
← AI PulseJul 22, 2026

Wire · news · Multi-source brief

Grok Build Permissions and Plan Mode

xAI details how permissions control tool calls within Grok Build, distinguishing them from sandbox limitations, and describes the agent's plan mode.

By Illumora Editorial · Jul 22, 2026

Synthesized from multiple allowlisted primaries on the same event. Lanes →

Brief drafted by Illumora’s editorial model from the linked primary source. Ops desk reviews flagged pieces. How we write →

Read the source →xAI Docs — Permissions | SpaceXAI DocsProvenance JSON →
  • xAI's documentation for *Grok Build
  • outlines the system's permission modes, which govern what the agent is allowed to execute. These permissions are distinct from the sandbox, which restricts approved calls' access to the filesystem and network. The documentation also introduces a plan mode, where the agent drafts a plan for user approval before making edits.

Key Points

  • Permissions determine which tool calls Grok Build may run.
  • The sandbox operates separately, limiting what an approved call can do on the filesystem and network.
  • Grok Build offers permission modes including auto, ask, and always-approve.
  • Users can configure the default permission mode in ~/.grok/config.toml.
  • Plan mode allows the agent to explore a codebase and draft a plan for approval before any edits are made.
  • In plan mode, only the session plan file can be edited until approval; other edit tools are rejected.
  • Subagents inherit the parent's permission mode but are not edit-gated by the parent's plan mode.

Context

  • According to xAI, permissions in *Grok Build
  • manage the execution of tool calls. The system's sandbox, however, provides a separate layer of control, restricting the actions an approved call can perform on the filesystem and network. xAI also states that plan mode enables the agent to develop a plan for user review before implementing any changes. This mode is particularly useful for ambiguous tasks or high-impact restructures, as described by xAI.

Why It Matters

Understanding Grok Build's permission and plan modes is crucial for developers to manage agent autonomy and ensure controlled execution of tasks. These features directly impact how users can safely delegate complex operations to the agent, balancing efficiency with oversight.

What To Do

  • Note the distinction between permission modes, which control tool calls, and the sandbox, which limits filesystem and network access.
  • Review the available permission modes: auto, ask, and always-approve.
  • Test the plan mode for tasks involving ambiguous architecture or high-impact restructures.
  • Configure the default permission mode in your user configuration file (~/.grok/config.toml).