>I think specifically we want a plugin to be able to indicate if it's safe for it to be triggered without the user's direct consent

It should really be on an endpoint by endpoint basis, since a single plugin can have several different endpoints.