---
title: "How to Enable YOLO Mode in Grok Build | AgentRQ Guidelines"
url: https://agentrq.com/guidelines/yolo-mode/grok-build
description: "Grok Build YOLO mode is Always-approve: grok --always-approve (alias --yolo), Ctrl+O or /always-approve. Auto mode, sandbox profiles and AgentRQ."
---

![](https://agentrq.com/assets/agent-icons/grok-build.svg) Checked October 30, 2026 | [All YOLO Mode guides](https://agentrq.com/guidelines/yolo-mode/)

# How to Enable YOLO Mode in Grok Build

xAI's Grok Build calls its YOLO mode **Always-approve**. Start it with `grok --always-approve`, or its alias `grok --yolo`. In a running session, press **Ctrl+O** or type `/always-approve`. Deny rules and PreToolUse hooks still apply.

This page is one of our [YOLO mode guides](https://agentrq.com/guidelines/yolo-mode/), and part of our guide to [YOLO mode in every coding agent](https://agentrq.com/blog/what-is-yolo-mode-and-how-to-turn-it-on-in-every-coding-agent). Everything below was checked against xAI's Grok Build docs at docs.x.ai and the documentation bundled with Grok Build 1.0.73 (@xai-official/grok) on October 30, 2026.

![Animated sketch of YOLO mode in AgentRQ: claude waits to run go test, YOLO is flipped on for the task, and every later edit and test run lands auto-allowed in the Trajectory view](https://agentrq.com/assets/sketches/yolo-mode.svg)

## Grok Build's Permission Modes

| Mode | What it does |
| --- | --- |
| Ask (default) | Asks before any tool call that isn't already allowed. Read-only tools and read-only shell commands run. |
| Auto | A classifier approves safe tools. Dangerous ones may still ask. |
| Always-approve | Approves every tool call. Deny rules and PreToolUse hooks still apply. |

**Plan** mode is separate. It restricts edits while Grok plans, and its plan review still appears under Auto or Always-approve.

## How to Enable YOLO Mode in Grok Build

| Where | Always-approve |
| --- | --- |
| Command line | `grok --always-approve` or `grok --yolo` |
| In a session | **Ctrl+O** or `/always-approve` |
| Keyboard cycle | **Shift+Tab**: Normal, Plan, Auto (when available), Always-approve |
| Config | `permission_mode = "always-approve"` under `[ui]` in `~/.grok/config.toml` |
| Headless | `grok -p "..." --always-approve` |

bash

```bash
grok --always-approve
```

The config key goes in your user config only. Grok does not read it from a project's `.grok/config.toml`. The older keys `approval_mode` and `yolo = true` still work, and `permission_mode` wins if more than one is set.

Headless runs (`grok -p`) cannot ask, so without Always-approve any tool call that needs approval is refused.

### The Halfway Option

**Auto** (`/auto`, or `permission_mode = "auto"`) lets a classifier approve the safe calls. For hard lines, add rules to the `[permission]` section of the config:

toml

```toml
[permission]
rules = [
  { action = "allow", tool = "bash", pattern = "git *" },
  { action = "deny",  tool = "bash", pattern = "rm -rf *" },
]
```

`deny` always beats `allow`. The `--allow` and `--deny` flags take the same patterns for one run.

## Grok Build's Sandbox

Always-approve does not touch the sandbox. They are separate layers: permissions decide which calls run, and the sandbox limits what an approved call can reach. The sandbox is off by default. Turn it on with `--sandbox <profile>`, the `GROK_SANDBOX` environment variable or `[sandbox] profile` in your config. Built-in profiles include `workspace` (write only to the project, `~/.grok` and temp directories), `read-only` and `strict`. It uses Landlock on Linux and Seatbelt on macOS, and if it cannot be applied, Grok logs a warning and carries on without it.

## How to Enable YOLO Mode in Grok Build Through AgentRQ

Always-approve covers a whole session. AgentRQ lets you make the decision per task, and answer from somewhere other than the terminal.

### Approve From the AgentRQ Task Instead of the Terminal

Connect Grok Build to an AgentRQ workspace through the [ACP Gateway](https://agentrq.com/docs/connect-acp-agent) ([Grok Build setup guide](https://agentrq.com/docs/agents/grok-build)):

bash

```bash
npx @agentrq/acp-gateway@latest --agent grok-build
```

The gateway runs `grok agent stdio`, without `--always-approve`. Grok's own agent-mode docs recommend `grok agent --always-approve stdio` for SDKs and servers, so don't add it here, and leave `permission_mode` at `ask` in `~/.grok/config.toml`. ACP clients can also turn on Always-approve per session with `"_meta": { "yoloMode": true }` on `session/new`. AgentRQ does not send that.

Grok Build sends permission prompts over ACP whenever the session is not in Always-approve. They show up in the AgentRQ task on the web, on your phone or in Slack, together with the command or edit they are about. Answer **Allow Once**, **Always Allow** or **Deny** from wherever you are, and Grok carries on. If nobody answers within 30 minutes, the gateway cancels the turn instead of guessing. Change the limit with `--permission-timeout`.

### Turn On YOLO for One Task

Flip the **YOLO** toggle on a task, or when you create it, to put just that task in [YOLO mode](https://agentrq.com/features/yolo-mode). Every permission request in it is approved automatically and Grok Build never waits, while every other task in the workspace still asks. [Scheduled tasks](https://agentrq.com/features/task-scheduling), [event triggers](https://agentrq.com/features/events) and [workflow](https://agentrq.com/features/workflows) steps have the same switch, so an unattended job can run in YOLO while your interactive work stays supervised.

![The YOLO toggle on a task in AgentRQ being switched on, then off again](https://agentrq.com/assets/guidelines/yolo-mode-task-toggle.gif)

### Turn YOLO On or Off in Workspace Settings

To make YOLO the default for a whole workspace, open the workspace, go to **Settings**, choose the **Automations** tab and flip **YOLO Mode (Execute All)**. Click **Update Workspace** to save. Switch it off the same way. The switch is off by default, and every permission request in the workspace is approved automatically while it is on.

![Workspace Settings in AgentRQ: the YOLO Mode (Execute All) switch turned on and saved, then off and saved](https://agentrq.com/assets/guidelines/yolo-mode-workspace-settings.gif)

### A Safe YOLO Setup for Grok Build

- → **Allow the boring tools, not everything.** **Always Allow** adds the tool to the workspace's auto-approved list, so the routine calls stop asking and the risky ones still do. Prune that list in workspace settings now and then.
- → **Keep deny rules in config.** They still hold when a task runs in YOLO, the same as under Grok's own Always-approve.
- → **Leave the workspace-wide switch off.** Turn YOLO on per task instead, so it never outlives the job you trusted.
- → **Turn on the sandbox.** Set `[sandbox] profile = "workspace"` so YOLO tasks can only write inside the project.
- → **Read the record.** The [tool call history](https://agentrq.com/features/tool-call-history) lists every call the task made, including the ones that were auto-approved.

## FAQ

**How do I enable YOLO mode in Grok Build?** Start it with grok --always-approve, or its alias grok --yolo. In a session, press Ctrl+O or type /always-approve.

**How do I make Always-approve the default in Grok Build?** Set permission_mode = "always-approve" under [ui] in ~/.grok/config.toml. Project config files are not read for this setting.

**Do deny rules still work in Grok Build's YOLO mode?** Yes. Deny rules and PreToolUse hooks still apply under Always-approve.

**Does Grok Build have a sandbox?** Yes, off by default. Turn it on with --sandbox and a profile such as workspace, read-only or strict.

**How do I approve Grok Build commands remotely?** Connect Grok Build to [AgentRQ](https://agentrq.com) through the ACP Gateway. Its permission requests show up in the task on the web, your phone or Slack.

For every other agent, see [what YOLO mode is and how to turn it on in every coding agent](https://agentrq.com/blog/what-is-yolo-mode-and-how-to-turn-it-on-in-every-coding-agent).