Before relying on the Claude Code plugin day to day, it's worth understanding exactly what it can and can't touch.
A single scope
The plugin operates under one OAuth scope, granted once when you connect (see Connect the Claude Code plugin) — it doesn't request escalating permissions over time.
It never publishes or deletes
Every article it creates or edits lands as a draft. It never publishes anything, and it never deletes content.
The two exceptions
There are exactly two actions that touch something already live, and both require your explicit confirmation before proceeding: updating a public developer-docs version's release notes, and refreshing an already-published API reference. Every other action it takes is either a draft or a reversible, confirmed structural change (like renaming a category).
Attribution
Changes it makes are attributed to whichever team member is signed in and connected — not to a generic "Claude Code" identity — so your activity logs reflect who was actually driving.