Grok Bot: Tighter OAuth scopes for connectors and fixed approval for mutable calls

Ideas Feature Requests
, ,
1

I want to use more of the connector apps on grok bot but a lot of them request write access in the OAuth grant with no way to configure the scope.

From what I understand after that grant, a write is not stopped by any fixed in-code rule but rather “Auto Review” checks the action before it runs. In the docs it says its an independent review model so whether a write stops for approval depends on that models decision.

I would like two controls for the connectors:

  1. Let me cap the OAuth scope, read-only should be the default with write, send, delete, etc.. being off unless I opt in.
  2. I want the capability to enable a “fixed check” , where for each mutating call ( POST / PUT / PATCH / DELETE ) I am guaranteed to get an approval card. This check should happen in code and the review model should not have any choice in this decision. This means I might get an approval card for some harmless post calls but I much prefer this over a write request going through without me allowing it first.

I think Auto Review is useful but I would like to have more controls on top of it.

Mentioned docs: Grok Bot security | SpaceXAI Docs