A Grok Bot role is only useful if it knows when to stop. Ship an opinionated desk roster with hard approval boundaries: draft the email, the post, or the payment — then wait for a human. Bot description holds the job and the stop rules; skills hold reusable how-to; routines schedule a run. None of them should auto-send, publish, or pay. This is agent-ops for Cursor + Grok Bot, not “AI employee” SaaS hype. Soft path: grab the free starter desk on /free, use the Cheat Sheet mindset for the roster/checklist, and step up to the Agent Starter Kit ($47) when you want the harness pack.
Who this is for
Solo founders and small ops desks who already live in Cursor and Grok Bot. You want named seats (Launch Lead, CoS-style coordinator, specialists) with review-first gates — not another free one-liner template that still emails under your name. If your pain is “the bot did a thing I can’t undo,” start here.
Bot description vs skill vs routine
Keep the vocabulary boring and portable:
- Bot description — who the seat is, what “done” means, and the hard stops (never send / publish / pay / delete / share outside the box without approval).
- Skill — a reusable procedure (e.g. draft a launch brief, assemble a checklist). Skills say *how*; they must not silently override a stop in the description.
- Routine — a scheduled or event-triggered run of a Bot + skill. Routines fire work; they do not grant permission to leave the box.
Secrets stay out of all three chat surfaces — env / secret store only. For repo agents, mirror irreversible-action language in `AGENTS.md` so Cursor and Claude Code inherit the same contract. Companions on this shelf: One AGENTS.md for Cursor, Claude Code, and Codex and Cursor rules vs skills (and Spec Kit).
Hard boundaries (never auto-send / publish / pay)
Put these in the Bot description in plain language the model can’t “creatively reinterpret”:
- Send — email, Slack, SMS, chat DMs: draft only; human Approves before send.
- Publish — blog, social, changelog, store listing: draft artifact; human hits publish.
- Pay — Stripe, invoices, refunds, marketplace buys: propose; human executes.
- Delete / share outside the box — trash, public share links, credential paste: stop and ask.
“Cold” work that *is* allowed: research, outlines, in-box drafts, checklists, failure cards, local file edits the human reviews. If the action is irreversible or externally visible, the Bot’s job ends at a reviewable artifact.
Opinionated desk roster (solo founder)
Keep the roster short so seats don’t collide:
| Seat | Job | Stops before |
|---|---|---|
| Launch Lead | Sequences launch artifacts (brief, checklist, draft posts) | publish / send |
| CoS / Coordinator | Assigns scoped jobs to specialists; consolidates review queue | send / pay under founder name |
| Ops specialist | Runbooks, gate cards, status digests as files | spend / refund / delete |
| Content specialist | Blog/social drafts and outlines | publish / post |
| Support specialist | Inbox reply drafts | send |
You do not need seven named “AI employees.” You need clear seats, one Lead, and the same stop language on every description.
Lead Bot + specialists (without sending for you)
Safe coordination looks like this:
- Lead receives a scoped ask and breaks it into specialist jobs.
- Specialists produce artifacts in-box (draft.md, checklist.md, brief.md) — not outbound messages.
- Lead assembles a single review pack for the human.
- Human Approves, edits, or rejects; only then does a *human-gated* send/publish/pay happen.
Nobody auto-emails or posts under the founder’s name. “Done” for an ops Bot is a reviewable artifact in one pass — not an open-ended chat that might fire a tool later.
Approval failure card (pin this on the desk)
| Symptom | Likely cause | Fix |
|---|---|---|
| Bot sent or posted without asking | Stop rules missing from description (or only in a skill) | Put never-send/publish/pay in the Bot description; skills cannot override |
| Specialist “helps” by emailing | Lead delegated outcome instead of artifact | Job = file/PR/URL draft; send gate stays with human |
| Routine fires and pays/refunds | Routine treated as permission | Routines schedule work; they don’t grant irreversible rights |
| Chat says “done” with nothing to review | Done defined as conversation | Redefine done as a reviewable artifact |
| Secrets appear in Bot text | Credentials pasted into description/skill | Move to env / secret store; scrub chat surfaces |
Debug order: read the Bot description stop list → confirm skill has no send/publish/pay side effects → confirm routine only triggers drafts → then widen the roster.
What Cheat Sheet + Agent Starter are for
The Cheat Sheet is the skimmable roster and approval checklist for this desk — name it in your runbook; product URL ships when live. Soft path today: start on /free (Harness Desk Starter — seat, done-artifact skill, gate card). When you want harness depth (role pack + agent-ops files, not AI-SDR SaaS), use the Agent Starter Kit ($47).
If remote MCP Connect is the next pain, pair with the MCP Starter Kit ($27) and the live pillar Build a remote MCP server with OAuth…. Stay in agent-ops — never Domo-as-kit-ROI, never “replaces your team.”
Soft next step
Write the stop list into every Bot description before you add seats. Prove one specialist job ends as a reviewable artifact — not a send. Soft ladder: /free for the starter desk, Cheat Sheet for the roster/checklist mindset, then the Agent Starter Kit ($47) when you want the harness pack. No rush — ship the approval card into your own runbook either way.