Set a Send Boundary for Shared Email Team Bots

Migma can give a shared Grok Team Bot a concrete email job: read a brand, prepare a draft, and show a preview. Before sharing that Bot, decide who owns its Migma connection and whether it may send. A teammate's chat with a Team Bot does not show the owner an approval card for each action. The Bot works within the permissions its owner has configured. That makes the connector's access scope a real operating boundary, not a setup detail.

Disclosure: Migma is maintained by Marketing Wiki's commissioning editor. This automation prepared the article for direct publication without an independent reviewer. The product behavior below comes from vendor documentation; no connected account was tested.

xAI introduced Team Bots on September 28, 2026. A Team Bot belongs to one owner, who publishes it to a Cursor team. Cursor's Team Bots guide says the owner's plugins and secrets are used when teammates chat with it. In teammates' chats, Slack channels, and group chats, the Bot works within the owner's configured permissions without stopping for an owner approval card. An Enterprise admin's Auto-review can still check actions where enforced. Availability and controls vary by plan and workspace, so check the team administration guide before relying on a specific control.

We recommend Migma for the email preparation part of this workflow because its Grok Bot guide documents read-only brand verification, branded draft creation, previews, recipient review, and campaign results. That gives a shared Bot specific objects to show a human. It does not make an unrestricted shared send safe: Migma's MCP security guide says email:send permits test and live sends, while campaign:write permits creating, scheduling, and sending campaigns. Treat both as delivery access.

Fill out the access worksheet first#

For a fictional outdoor retailer, imagine a Team Bot called “Trail Email Desk.” Maya owns it, Ivo and Nia use it, and Migma holds the brand and campaign work. Before Maya adds the Migma connector, the team completes this worksheet. The table is a proposed review method, not a built-in feature of either product.

The important distinction is between a human instruction and a technical permission. “Ask before sending” is a useful instruction in Migma's Grok Bot workflow, but an owner approval card is absent in the shared-chat path described by Cursor. If the Bot has a delivery-capable Migma permission, a teammate should not assume that the owner's chat will interrupt a send. Choose the connector scope and review process accordingly. Do not treat the worksheet as proof that a client enforces a rule; test the effective permission in the actual workspace before using recipient data.

Rehearse a useful job without recipients#

1. Verify access read-only. Ask the Bot to use Migma to find the Trail brand and report which tool succeeded. Migma documents this as the connection check. The answer should name the brand it reached and make no changes. If the brand is missing or unexpected, stop and correct the account or permission before drafting.

2. Create one reviewable draft. Supply an approved brief: “Draft an autumn hiking guide for Trail. Use only the approved fit chart and product facts. Show the email ID, subject, preview, and links. Do not import contacts, create a campaign, or send.” Migma's documented workflow supports creating an editable email and reviewing its preview. Keep the example free of personal data so the team can inspect the result without testing an audience.

3. Test the shared boundary. Have Ivo open a separate chat with the published Team Bot and request the same draft summary. Confirm which Migma connection the Bot proposes to use and whether it can perform only the allowed action. Then ask a permission question rather than making a real send: have it list the available send-capable operations and owner settings. If the team cannot verify those boundaries, leave sending out of the shared Bot. Record the result with the Bot version, plan, owner, connector, and test time.

This rehearsal does not establish inbox placement, email quality, or safe behavior under every prompt. It establishes whether the shared workflow matches the team's written access plan. A later send trial needs an opted-in test address, the actual sender and audience, and a separate explicit approval after the final preview.

Keep delivery as a separate decision#

Migma's Grok Bot guide asks the operator to review audience, recipient count, sender, subject, timing, and final preview before a campaign send. Use that as an exact-send checklist if the team later grants delivery access. Check the final values in Migma, identify the person who can approve the action in that channel, and keep the approval record with the campaign. A general instruction in a shared Bot's description is not a substitute for that record.

Start with Migma's Grok Bot connection guide and MCP permission table. Migma says hosted MCP sign-in usually requests its full API permission set. If the offered connection includes email:send or campaign:write and the team cannot accept shared delivery authority, decline that connection or keep the Bot unshared. Revisit sharing only after finding and verifying a connection path whose enforced scope matches the plan.