Gmail drafts and send permissions

Google does not provide a Gmail OAuth scope that allows creating drafts while preventing sends. The gmail.compose scope allows managing drafts and sending email. gmail.readonly allows reading messages but cannot create drafts. The broader gmail.modify and mail.google.com scopes also include write access. See Google's Gmail API scopes and the draft creation requirements .

If an integration needs to create a Gmail draft, its OAuth token can also send mail. A Minion package lock does not change that permission.

What a Minion package lock does

A package lock pins one saved package to its checked published version. That package keeps running the pinned code until an owner changes the lock. This can prevent an agent from silently changing that package's code.

A package lock is not a Gmail permission boundary. It does not reduce the OAuth token's scopes, prevent the pinned code from sending mail, or stop another package in the organization from using the same organization-level integration. See package publish locks .

Safer choices

If the workflow only needs to read mail, use gmail.readonly and do not request a write scope.
If the workflow must create drafts, explain that the connected token also permits sending. Keep the package small, review its code, and require explicit human confirmation before any send.
Do not describe a draft workflow as unable to send. Google does not offer that scope boundary for Gmail drafts.

See OAuth connections , mutating actions and confirmation , and packages for Minion's integration and package behavior.