Read-only access until you allow changes
Gmail, Google Calendar and GitHub connect read-only at first, and one click on Allow changes upgrades the same connection to write access.
What it includes
Mail and calendar read first
Gmail and Google Calendar start able to read, and Allow changes adds sending, filing and event edits to the connection you already have.
GitHub writes only where you choose
Write access to GitHub comes through a separate app installed only on the repositories you pick.
Connections
See every account you have connected and every service still available on one page, each row naming the access it currently holds.
Reconnect a connection that lapsed
An amber dot marks a connection the service revoked or rotated, and Reconnect asks for the same permissions again without dropping the rest.
GitHub reaches only the repositories you pick
Connecting GitHub installs an application you point at chosen repositories, and a Repositories link reopens that choice at any time.
Tools gated on the access you gave
A tool whose permission you did not approve never reaches the agent, so a read-only Gmail connection cannot send or delete anything.