Plugin Permissions
Plugin permissions include read/write access for posts, pages, assets, profile, manifest extensions, plugin state, export hooks, tracker fetches, external fetches, and deploy providers.
Sensitive Permissions
write:posts, write:profile, write:manifestExtensions, fetch:external, and deploy:provider require extra creator review because they can alter public output or contact external services.
Boundary Rules
Permissions describe intent. They do not grant automatic runtime execution, and public plugin assets still need route declarations plus export safety checks.