It reads the destination, so it has to connect to it

The repository itself, through the QED Proof GitHub App with read-only permissions: is the commit on the branch, is the pull request open, did the check runs on that commit pass.

The URL, fetched from our network at a pinned address, for the status the agent claimed. No connection needed.

Messages the agent says it posted, read from the channel itself with a read-only user token: is there a message at that timestamp, and does its text match when the agent says what it wrote.

The post by its ID: does it exist, did it come from the connected account, and does its text match when the agent says what it wrote.

The ad account's own activity log — budget and bid edits with old and new values, and which app made them. Connect read-only (ads_read) today.

The Page's own published posts. Connect read-only today; the post verifier is next.

The account's own published media, including Reels. Connect read-only today; the verifier is next.

Connect GitLab accounts read-only today. Verifiers for commits, merge requests and pipelines — the same checks as GitHub — are next.

Messages sent from a business number. Waiting on Meta's Embedded Signup.

Whether the email really left the mailbox. Gated on a connector catalogue and pricing check.

The account's change history (change_event), after Meta Ads — the second connector pipelines are designed around.