Nothing changes until you have read the plan.
Builds, deployments, and shared services each produce a plan and print its hash. Apply takes the hash of the plan you reviewed. If the config, a secret, or the target moved in between, mm stops and asks you to plan again.
How plans work