Approve work that reaches a sensitive integration

Only owners mark integrations sensitive and approve Blueprint versions. Sensitive integrations and approvals explains which integrations are sensitive and what an approval covers.

Work that reaches a sensitive integration starts only with a version that an owner approved. A version that an owner commits from a draft they wrote last is approved. Any other version waits: blueprints.commit and blueprints.bind return a warning, and starting a task fails with OWNER_APPROVAL_REQUIRED until an owner reads the version and approves it:

{ "organizationId": "<organization id>", "versionId": "<version id>" }

devboxes invoke blueprints.read --input @approve.json
devboxes invoke blueprints.approve --input @approve.json

To mark a secret sensitive, give its id from secrets.list. For a connected MCP server, use "kind": "integration" with its id from integrations.list:

{
  "organizationId": "<organization id>",
  "integration": { "kind": "secret", "id": "<secret id>" },
  "sensitive": true
}

devboxes invoke integrations.configure-sensitivity --input @sensitive.json

integrations.sensitivity lists the sensitive integrations. Only owners mark them and approve versions.