Before connecting Gmail, Drive, Stripe, GitHub or calendar to a Grok Bot, runs a minimum-scope checklist and returns CLEAR or NEEDS ACTION. Never connects.