The docs say this:

You might get an error whent the action is run. If you open the error log and see something like this:

"Error: Resource not accessible by integration"

To fix this, go to https://github.com/{owner}/{repo}/settings/actions and in Workflow Permissions section give actions Read and Write permissions. That provides the token with rights to modify your repo and solves your problem.

A) whent should be when
B) The job still succeeds with a 403
C) Consider augmenting the documentation to use

jobs:
  workitem-check:
    name: Description contains AB# with a valid work item id
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      issues: write
      contents: read
    steps:
      - uses: danhellem/[email protected]
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}

This may be easier for people to understand and the setting you mention can be disabled by orgs/enterprises (like mine):

Request:

• Fix spelling
• Make job fail when it should
• Improve documentation