Grok Bot Approval Stuck? Denied, Expired, and Auto-review Explained
A source-checked decision guide for pending or expired approvals, repeated Ask first cards, denied actions, and messages left as drafts.
Unofficial, source-checked guide. Reviewed against public xAI documentation and the October 23, 2026 Grok Bot v0.75.5 changelog. We have not tested your account or its approval policies. An approval card is a safety boundary, not an error to bypass.
First identify which state you see
A Bot can prepare a result yet pause before an external action. Check the conversation and the proposed action before restarting the task.
| What you see | What it means | Least-destructive next step |
|---|---|---|
| Approval waiting in a conversation you are actively using | The Bot is waiting for a decision about a particular action. | Read the target, recipients, scope and arguments; choose Allow once only if correct, or Deny. |
| Expired on an approval from a routine, trigger, or another Bot | The unattended approval window elapsed; the action did not run. | Review the task, then ask the Bot to try the action again if it is still wanted. |
| Denied and no further action | The action was blocked. In v0.75.5 the Bot stops retrying that denied action until you send another message. | Correct the request and send a new instruction. Do not silently retry or loosen the rule. |
| Draft created but not sent | Drafting and sending are different actions; a routine or other unattended turn may stop at a draft. | Inspect the draft, then explicitly approve or request sending only when appropriate. |
| Ask first appears repeatedly | A personal or administrator-enforced rule may require approval. | Review Settings → General → Auto-review and matching rules; ask your admin about locked team rules. |
The official approval documentation distinguishes approvals in a live chat from unattended approvals. The latter expire after about 10 minutes, not at a universal scheduled reset time. An expired card's possible Always allow this in the future option creates a future rule; it does not execute the expired action.
A safe five-step recovery
- Inspect the actual action. Note the app, destination, recipients, amount, file or permission change. Do not approve an unclear operation.
- Check whether anything already happened. Look in the destination app for a sent message, changed record or created file before requesting a repeat. This avoids accidental duplicates.
- Use the correct response. For a valid pending card, choose Allow once. For an incorrect target, Deny, then send a corrected request. For an expired unattended card, ask for a fresh attempt only after checking the destination.
- Check rules only if approval repeats. Under Settings → General → Auto-review, Ask first takes precedence over Allow automatically. Team-enforced rules cannot be relaxed by a personal rule.
- If the Bot is still stuck, check for a waiting question, login, CAPTCHA, connector sign-in or usage problem. Use the official troubleshooting flow before attempting a destructive computer reset.
For a concrete example, ask: “Prepare a draft email to the vendor, show the recipient and full message, and stop before sending. Do not change the CRM. Ask me before any external action.” After review, send a separate explicit instruction if you actually want it sent. This is an example of a safer request, not a guarantee of product behavior.
What changed in the October 23 release?
The official v0.75.5 changelog says Auto-review now asks less often when the requested action is already explicit, retries some failed checks, and no longer approves an action the user said to stop before. It also says that after a Deny, the Bot waits for another message before attempting that action again.
The same release distinguishes messages you explicitly ask the Bot to send (which can send once Auto-review allows) from sends initiated by routines or other turns (which still wait as drafts). Do not treat a draft as proof of delivery, or assume every account and version has the same behavior.
Avoid the dangerous shortcut
Do not create a blanket “allow everything” rule to clear a stuck card. Narrow rules are safer: for example, require approval before sending any external email or changing a production dashboard. Always allow can persist for matching future actions; prefer Allow once while diagnosing.
Keep passwords, one-time codes, session cookies and private keys out of ordinary chat and public support reports. Use first-party takeover or secure input flows for sensitive authentication.
When to contact official support
Record the Grok Bot app version, operating system, Bot or routine name, the exact visible card state, approximate time and time zone, and any request ID. Include a redacted screenshot and say whether the action appears in the destination service. Do not send credentials.
Evidence boundary: This guide reflects public xAI docs last updated October 22 and the official v0.75.5 notes dated October 23, checked October 24, 2026. It is not an account-specific diagnosis or an independently verified hands-on test.