What actually stops a coding Bot (and what is only advice)

How this helps you

It shows that written rules are only advice. For anything risky, put a real block in place, such as a required check.

✦ Try it

List every action you could take in this repo and its connected tools. For each one, tell me whether something actually blocks it (a ruleset, required check or approval) or whether only an instruction asks you not to. Don't test anything destructive.

What they did

@coderifts_dev let a Bot loose on a repo and mapped 15 operations. Only one hit a hard stop: a merge to main, blocked by a ruleset with 2 required checks and an empty bypass list. Four were advisory (skill-file instructions) and five were ungoverned.

Who it's for: People letting Bots work on code repositories.

How to try it

List what would really hurt if it went wrong.
Put real gates (rulesets, required checks, approvals) on those.
Don't rely on skill text alone.

What to expect

A table of actions split into hard stops, instructions only, and nothing in the way.

Common mistakes

Treating rules in a skill file as a lock. They are advice the Bot can misread.
Testing destructive actions on a real repo to see what happens.

Related tips

How to trust your Bot's work more: Put most of your effort at the top: code structure, then lint/tests/CI, then prose rules, then human review.
A safety baseline before sharing logins: All your Bots share one computer, so every Bot can use each login.
Watch coding work live and get recordings back: With Cursor connected, your Bot links you to the cloud agent live and sends screenshots and screen recordings.
How the team uses its own Bot on support: It spots incidents and answers related tickets; a human approves the batch.
Roll out Grok Bot to a team with admin guardrails: From the official admin video: set team rules, auto-review, plugin and network allow lists, then start with a pilot group before inviting everyone.
Set up Auto-review rules: ask first for anything you can't undo: Turn on Auto-review, then add Ask first rules for money, publishing and sending. When rules clash, Ask first wins.