Mutating actions and confirmations
Some code you run in Minion calls GitHub, Cloudflare, or other APIs through fetch, an OAuth integration or a remote MCP server. Those calls can create, update, or delete remote data.
Before POST, PUT, PATCH, or DELETE (or any destructive or quota-consuming operation), confirm the exact path, HTTP method, and JSON body with the user unless they already approved that precise operation.
Official references:
The identity that owns tokens and approvals is the one configured for your Minion team (for example a shared automation account), not necessarily the end user's personal account.