OAuth, not an API key you paste
The connector uses an authorization code flow with a consent screen you have to read. There is no step where you copy a long-lived secret into a chat window, because that step is where most integrations quietly leak.
Scopes that map to real operations
Read, write and comment are separate grants, and the consent screen names them in plain language rather than as opaque strings. Read-only is a genuinely useful mode, which is why it is offered first.
Every write is attributed and reversible
Writes carry the actor into the task history, and batched writes get an undo token that stays valid for thirty days. Destructive operations require the task id, never a name match, so a bulk delete cannot be triggered by an ambiguous phrase.
Rate limits are a safety feature
The endpoint is rate limited per token, and it says so when it refuses. A runaway loop hits a wall in seconds rather than rewriting a workspace, and you find out from the error rather than from the damage.