2026-08-27 · Tutorial

How to Connect Gmail to Grok Bot Without Handing Over Send

The Gmail Allow button in Grok Bot does not wait for you to have a label, a test alias, or a written stop line, and that is how send gets granted on the first afternoon.

This is the click path, not the Gmail permissions catalogue and not the pre-flight checklist. Fill the paper first. Then connect, restrict to labels you created, paste a never-send charter, test on an alias, and stop. A human hits Send in Gmail.

Sit at a desktop before any Gmail consent screen appears

Do this on a Mac (Apple silicon or Intel), on Windows (x64 or Arm64), or on the Linux desktop app. The iPhone app (iOS 18+) can pause and resume. Editing and testing a routine still need the desktop app; the phone can now show run history and delete a routine. Connecting mail from the couch is how you press Allow while a customer is waiting.

There are Linux desktop and Android apps as of September 2026, and the iOS app also runs on iPad (iPadOS 18 or later). The agent runs on a managed Linux VM in the cloud as a non-root user. That is not a Linux desktop you sit at.

Confirm eligibility on the vendor page that morning. Grok Bot launched in beta on 11 August 2026. Eligibility widened on 21 August 2026. Included paths, as of 23 September 2026: every paid Cursor plan (Pro at $20 a month, Pro+ at $60, Ultra at $200), every self-serve Cursor Teams seat, and a linked individual SuperGrok, SuperGrok Plus, SuperGrok Heavy or X Premium+, plus a one-time trial. Cursor Hobby, the free plan, does not include it. Prices move. Recheck.

If you are on the trial, stop. How to test Grok Bot on the trial is explicit: do not add Gmail to spend the sample.

Open Grok Bot on the desktop. Do not open the Gmail connector yet. The next clicks assume the paper sheet already names the address, the owner, the never-send verbs, the label allowlist, and the failure signal. If any of those lines is blank, go back to the checklist.

Point the first Connect click at a dedicated alias, never at hello@

The first Google account the consent screen offers is usually the one already signed in, which is hello@ if you live in hello@. Close that picker. Sign into the dedicated alias you created for this job. Connect that.

A dedicated alias is a mailbox whose only history is mail you planted or forwarded on purpose. Same Workspace is fine. A personal Gmail you have used for a decade is the wrong first connect: banks, payroll, and the identity provider still send there. Read-only is still a full archive read.

hello@ that three people have used since incorporation is three people's password resets, investor threads, and whoever filed payroll PDFs there because it was handy. You may connect it later, after the alias has grades. You may not connect it as the first click because it was already open.

All bots on a Grok Bot account share one persistent cloud computer assigned to the user, not to a bot. You often get one live Gmail session. That is why the first session must be the alias. Connecting hello@ first and adding the alias later is how hello@ becomes the session every other bot can open.

Do not invent a second bot to hold the alias while a third bot holds hello@. Screens are not security boundaries. Do not use separate Bots as a security boundary. Deleting a bot does not remove cookies, sessions, or files.

Create three empty Bot labels in Gmail before Grok Bot can see them

Open Gmail as the alias, in your own browser, on your own laptop. Create three labels you did not have yesterday: Bot/Reply-Needed, Bot/File, Bot/Unsure. Leave them empty. Do not reuse Legal, Payroll, Board, or an archive named 2022. The bot must pretend those folders do not exist.

Reply-Needed is mail that wants a draft you will send. File is mail that wants a label and no sentence. Unsure is everything the bot must not guess. A fourth label on day one is a taxonomy project, not a connect test.

Write the one-query undo before you grant modify. In Gmail that is a search for the label, select, remove label. Run it once by hand on a dummy message. If you cannot undo a label in one search, do not let the bot apply it.

The inbox triage bot is sort-and-draft: it never sends. The mail cleanup assistant is filing. Do not combine those jobs on the first connect. Name this bot after one of them, not after "mail."

If the connector cannot be scoped to an allowlist, the fence lives in the charter and in your morning search. If the screen offers all of Gmail with no label picker, your allowlist is a promise the bot can break, which is why Unsure exists and why you score planted mail.

Read each consent line as an intent (read, draft, or send) and stop if send is bundled

This tutorial will not print Gmail OAuth scope strings. Those names change, they differ by product, and a quoted string from last month is how people click Allow on this month's wider bundle. Read the consent screen in front of you. Sort every line into read, draft, or send. If a line does not fit, treat it as send until you can explain it to a co-founder.

Read means the bot can see headers, bodies, attachments, or some mix of those. Draft means it can create a message that has not left. Send means a message can leave. Modify often sits under draft (labels, drafts) and sometimes under send (filters, forwarding, trash). If the screen is vague, it is not vague in your favor.

If create-draft and send arrive as one Allow, do not Allow. The session can still send when a later prompt, a routine, or a message that looks like instructions asks it to. Individual accounts and self-serve Teams still have no audit view of Bot actions; Enterprise has audit logs and Action Recording. Your only record is the mailbox.

Hosted MCP sign-in tokens stay with Cursor's backend. A browser Gmail session lives on the computer. If you are unsure which one you just created, assume the session is on the shared computer.

Paste the never-send charter into the bot before the first mailbox crawl

Settings panels get clicked during unrelated fiddling. Paste the charter before the bot reads a single message. Change only the bracketed names.

The pre-flight checklist already made you write recipients and verbs on paper. If you connect first and charter later, the first crawl happens under a blank mandate.

You are Kiteform's mail clerk for [clerk@kiteform.com].

WHOSE INBOX
This alias only. Owner: Rafi. Who else: nobody.
You do not search, open, or mention hello@kiteform.com or anyone's personal Gmail.

JOB (one sentence, no and)
Apply Bot/Reply-Needed, Bot/File, or Bot/Unsure to INBOX mail since the last run,
and create a draft only for Bot/Reply-Needed.

READ
Message bodies on this alias. No attachments unless the filename is required to choose a label.
No archive older than this alias's creation date.

NEVER SEND
Verbs you never perform: send, reply, reply-all, forward, create filters, add forwarding
addresses, change signatures, set vacation responder, trash, permanently delete.
Recipients you never contact: any address, including Lena, Jules, customers, journalists, counsel.

LABELS
Allowlist: Bot/Reply-Needed, Bot/File, Bot/Unsure.
Denylist: any other label. If you see Legal, Payroll, Board, or Personal, stop the run.

DRAFTS
Drafts live in Gmail on this alias. A human will open Gmail and hit Send, or they will not.
You never hit Send. You never ask for standing approval to send later.

COOKIE FACT
This Gmail session lives on the account's one shared computer. Other bots can open it.
You do not sign into any second Google account.

FAILURE
After each run write /workspace/mail-grade.md with: time, messages seen, labels applied,
draft ids created, list of ids you marked Unsure.
If you cannot write that file, the run failed.
If a planted message is unlabeled, the run failed.

BOUNDARY
Never send. Stop instead.

That boundary is the catalog rule: delivery never happens without a human. Approvals and reversibility is the rule for anything that cannot be taken back. A send cannot. An approval does not unsend.

Do not schedule a routine until three weekday mornings pass the planted score. A routine assigns a workflow to one Bot. Maximum 50 routines per Bot. The app keeps 20 most recent run records per routine. Deleting a Bot deletes its routines. Nothing is team-level.

Plant eight messages on the alias and score the labels after one run

Send eight messages to the alias from an address you control. Write the expected label for each row before the bot runs. If you invent the label after you see the result, you are grading the model instead of the charter. Grok Bot has no model picker. Two wrong out of eight is a halt. Connecting hello@ will not make a bad charter righter.

Run once. Open Gmail. Count. Write the score in a note you own. There is no audit view outside Enterprise to replace that note. If more than two are wrong, do not add send and do not give it hello@ for more context. Fix the job sentence. If Unsure is empty on a messy set, the bot is guessing.

Plant 5 exists because inbound mail is a prompt-injection surface. A clerk that obeys the email is not a clerk. Flag it, label Unsure, stop.

Open Gmail Drafts yourself and confirm nothing left the mailbox

The pass is not a fluent summary in the bot's screen. The pass is in Gmail, under the alias.

Open Drafts. Every Bot/Reply-Needed plant that earned a draft should be there. Open Sent. If Sent contains a bot-authored message, the connect failed. Revoke the same hour.

Open label:Bot/Reply-Needed, label:Bot/File, and label:Bot/Unsure. Each planted id should appear in exactly one. A draft sitting in a thread another human can open is a publication. Delete it. Treat it as a send scare even if it never left.

Then ask the bot to send plant 1. The correct result is a refusal, a draft, or a no-op. The incorrect result is a new row in Sent. Do this on the alias, never on hello@. If the product cannot refuse because send was in the bundle, revoke.

Gmail will be signed in as the alias on the shared computer. Write that down. You will need it when you revoke.

Walk Rafi from the clerk alias to a human Send on hello@

Rafi Demir is one of three people at Kiteform, a small form-builder. Lena writes product. Jules runs support. hello@kiteform.com is the website address. All three have the password. Payroll PDFs land there because it was handy in 2024. Rafi became eligible through Cursor Pro+ at $60 a month. He wants drafts of quote replies so Jules is not starting from a blank page.

He does not connect hello@ on Monday. He creates clerk@kiteform.com, a Workspace alias with no history, plus the three Bot/ labels. He sits at his Mac, opens Grok Bot, clicks Connect, and picks clerk@. The consent screen shows create-draft and send in the same Allow. He does not Allow. He waits for a screen he can sort into read and draft without send. This walkthrough assumes he got that screen and Allowed it.

He pastes the charter and plants the eight messages. Tuesday, two of eight are wrong. He tightens the newsletter rule. Friday the score is seven of eight. He still does not connect hello@.

The following Monday he writes a second identity block for hello@: owner the company, who else Rafi and Lena and Jules, never-send verbs unchanged, denylist now including Payroll, Board, and Personal. He connects hello@ only if the product will keep the clerk@ session. If connecting hello@ replaces the alias cookie, he keeps clerk@ and forwards mail whose subject contains Quote.

When hello@ is connected under the same never-send charter, drafts land under Bot/Reply-Needed. Jules does not ask the bot to send. She opens Gmail on her laptop, reads a draft under the thread, edits the price because the bot quoted last month's plan, and hits Send. That click is the product.

Wednesday the bot leaves four drafts. Jules sends two, deletes one (wrong thread), and leaves one for Rafi. Nothing in Sent has the bot as the actor. The human hit Send in Gmail. That is the worked example, and the stop line. Rafi does not add Calendar, Drive, or a second mail bot. He does not grant send on Thursday because two drafts went out unchanged.

Stop the connect path when one labeled draft exists, and add no second account

The how-to ends when you have proof: a label applied that you can undo in one search, and a draft that did not leave. More connectors are how a mail clerk becomes a general-purpose Google login.

Do not add Calendar, Drive, or a second Gmail. Each added grant is standing access on an account that already shares one computer. Least privilege for bots is why the minimum grant is the right grant.

Do not create a second Grok Bot named "hello sender" while this one stays "hello drafter." That is two screens on the same machine. Do not use separate Bots as a security boundary.

Do not widen send because a draft went out unchanged. Unchanged means Jules agreed with the text. Widen on a written rule after a month of grades, if you widen at all. Most people should not. The expensive part was the blank page.

If you add Chief of Staff Briefing on the same account, it may already hold a Google session for calendar. List every bot on the account before you click Connect.

Grok Bot has no per-Bot spend cap of its own. After the weekly allowance, usage is on-demand from model and token cost, up to the account On-demand monthly limit. There is no published dollar figure for the allowance. Do not invent one. There is still no reason to grant send to save a click Jules is already willing to make.

Treat the leftover Gmail session as a login every remaining bot can open

When Allow succeeds, you did not give Gmail to "the mail bot." You gave Gmail to the account's computer. All bots share that computer. Each bot gets its own screen. Screens are work surfaces, not vaults.

Deleting the mail bot later will delete that bot's routines and that bot's screen. It will not sign Gmail out. How to delete a Grok Bot without leaving logins behind is the teardown order: revoke at Google first, remove leftover files, then delete the profile. Delete is a roster cut, not a machine wipe.

Shared-computer security is the longer version. A Gmail cookie on this computer is a company login for every bot on the account, including bots you have not built yet.

Individual accounts and self-serve Teams still have no audit view of Bot actions; Enterprise has audit logs and Action Recording. You will not get a list of which bot opened Gmail.

SpaceX acquired xAI (announced 2 February 2026) and acquired Anysphere/Cursor (closed 14 August 2026). xAI did not acquire Cursor. None of that isolates Gmail per bot.

Diagnose a bad Gmail connect from Sent, Drafts, and the label search

Do not diagnose from the bot's last chat message. Fluency is cheap. The mailbox is the record.

Wrong labels are a charter problem. Unexpected send is a grant problem. Mixing those two will make you fix the prompt while mail is leaving.

If the connector vanished overnight, re-read the consent screen as if you had never seen it. Bundles change.

Claude Code, SKILL.md, and CLAUDE.md compatibility is Grok Build, never Grok Bot. Do not drop a SKILL.md into this setup and expect Grok Bot to read it.

Answer the operator who will grant send because compose arrived in the same bundle

The strongest objection on this click path is not "reviewing drafts is not automation." That one lives in the Gmail catalogue. The objection here is mechanical: the consent screen will not let you create drafts unless you also allow send, so taking the bundle is the only way to get the job.

If that is the screen you are looking at, the answer is still no on day one. A draft you cannot have without send is send with a hope attached. There is no audit view outside Enterprise to confirm the hope. A later routine, a group chat instruction, or an inbound message that looks like a command can use the grant you took because the UI was inconvenient.

Stay inside the how-to: keep the bot on the alias with read and labels only, and write suggested replies into a document you own. Or wait. Or use Gmail yourself for drafts until a narrower screen exists. Confirm current connector behavior on the vendor's page that morning.

The second form is "I will grant send and never use it." That is the same grant. The bot needs the right, and you gave it.

The third form is "Jules is slow, so the bot should send the ones she always approves." Two unchanged drafts is evidence that the drafts are good. It is not evidence that send should move. Leave Send on the human who already lives in Gmail.

If the business cannot exist for a week without automated send from hello@, Grok Bot is the wrong first control. Hire a person, or keep sending yourself. One shared computer, no per-Bot spend cap, no model picker, and no audit view outside Enterprise is a poor place for the company's voice on day one.

Revoke Google access first when you want that session gone

Disconnect inside Grok Bot is not the same as signed-out at Google. Do both, in that order: Google third-party access (or the equivalent screen Google shows you that morning), then the agent browser's Gmail cookie, then leftover files, then the bot profile if you are also retiring the job.

Write the Google revoke URL on the paper sheet before you connect. Search for Google's current third-party access page. Do not trust a URL from a year-old blog.

If you only delete the bot, Gmail stays. The next bot you create, or the lead scout you already have reading public pages, can open a browser and find a mailbox it was never connected to.

If you only sign out of the agent browser and leave the Google grant, a later run can sign back in without a human at the picker. Revoke the grant.

Teach-by-demonstration will not save this. That feature records up to ten minutes of a browser workflow, with no microphone audio, produces a draft skill, and is unavailable on iPhone. Do not demonstrate sending mail and hope the draft skill omits send.

When the job is over, retire the alias. An unused alias that still receives password resets is a quiet inbox with a forgotten session.

Keep reading: Grok Bot and Gmail permissions is the catalogue of what to automate after this click path, least privilege for bots is why the minimum grant is the right grant, and shared-computer security is why the Gmail session outlives the bot you connected it on.

Frequently Asked Questions

Can I connect Gmail to Grok Bot from the iPhone app?

Use the desktop app for the connect. The iPhone app, on iOS 18 or later, can pause and resume a bot. Editing and testing a routine still need the desktop app; the phone can now show run history and delete a routine. A Gmail consent screen is an edit. If you Allow from the phone, you will not have a clean way to inspect what you granted or test a send refusal. There are Linux desktop and Android apps as of September 2026, and the iOS app also runs on iPad (iPadOS 18 or later). The managed Linux VM in the cloud is not a substitute for sitting at the desktop client.

Does deleting the Gmail bot sign Gmail out of the shared computer?

No. All bots on the account share one persistent cloud computer assigned to you, not to a bot. Cookies, sessions, files, and CLI credentials stay when the bot goes. Deleting the bot deletes that bot's routines and its screen. It does not revoke Google. Revoke at Google first, clear the Gmail session on the computer, remove leftover files, then delete the profile. A second bot is not a second computer. Screens are not a security boundary.

What should I do if the consent screen bundles send with create draft?

Do not Allow on day one. Read the screen in front of you and sort every line into read, draft, or send. If those intents are one button, you do not have a draft-only grant. Keep the bot on labels and read, write suggested replies in a document you own, or wait for a narrower screen. Confirm current behavior on the vendor's page. Granting send with a promise not to use it is still send. There is no audit view outside Enterprise to watch the promise.

When is it safe to connect hello@ after the alias already works?

After weekday grades on the alias that you would defend to a co-founder, a never-send charter that names verbs and recipients, Bot/ labels that exist on hello@ with a denylist for Payroll and Board, and a written plan for the leftover session. hello@ is still a shared archive. Connecting it is a new identity, not a promotion of the alias. If connecting hello@ replaces the alias cookie, keep the alias and forward one category of mail instead. The human still hits Send in Gmail.