Critical-risk tools in Adrata
25 of the 395 tools in Adrata are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
bulk_delete_buyer_groupsDestructiveSoft-delete up to 50 buyer groups in ONE call, each cascading to its members. Use this instead of looping delete_buyer_group when cleaning many rooms out of a workspace.
-
cancel_agent_taskDestructiveCancel a queued or running agent/background task.
-
delete_actionDestructiveSoft-delete an action.
-
delete_buyer_groupDestructiveSoft-delete an entire buyer group (buyer room). CASCADES to every member seat in the room, so you do not need to empty it first. Does NOT delete the underlying people or the com...
-
delete_companyDestructiveSoft-delete a company.${governedWriteNote(
-
delete_noteDestructiveDelete a note.${governedWriteNote(null)}
-
delete_opportunityDestructiveDelete an opportunity.
-
delete_partnerDestructiveSoft-delete a partner relationship.
-
delete_personDestructiveSoft-delete a person.${governedWriteNote(
-
delete_webhookDestructiveDelete an outbound webhook subscription.
-
delete_work_itemDestructiveRetire a card as DELETED rather than archived. Rare, and deliberate. PREFER archive_work_item. The two do the same thing to the numbers; the difference is what the record says ...
-
delete_work_item_acceptance_criterionDestructivePERMANENTLY REMOVE one acceptance criterion from a card, taking its history with it. Reach for this ONLY when a criterion is unsatisfiable BY CONSTRUCTION — when no evidence any...
-
flag_work_itemDestructiveFlag unresolved work for the next repair and retest, or clear a flag once its reason is resolved. Ordinary failures remain visible and claimable. A FLAG IS NOT A TAG. The tag s...
-
forgetDestructiveSoft-delete a specific memory by ID. The memory will no longer appear in recall results.
-
paper_delete_documentDestructiveDelete a Paper document. Live writes require dryRun:false, approved:true, reason, and idempotencyKey.
-
paper_revoke_shareDestructiveRevoke a document share link, including Paper and Multiverse artifacts. Live writes require dryRun:false, approved:true, reason, and idempotencyKey.
-
remove_buyer_group_memberDestructiveRemove one person from a buyer group. Does NOT delete the underlying person record. To remove the whole room, use delete_buyer_group instead — it cascades.${GOVERNED_WRITE_NOTE}
-
remove_work_item_from_launchDestructiveTake a card off a launch. The card itself is untouched — it stays on its board in its column. Use this when a card was added in error or the launch no longer needs it; to say a ...
-
requeue_work_item_qa_after_fixDestructiveClear a failed QA card’s waiting-for-fix flag only after a different exact build has been deployed and its relationship to the failed build has been checked. This does not claim...
-
tag_work_item_criterion_staging_onlyDestructiveSay WHY one acceptance criterion cannot be checked locally, or clear that tag. Some criteria genuinely cannot be: a production provider with no local credential, a packaged ins...
-
unblock_work_itemDestructiveRemove a dependency that should not have been recorded — a link added in error, or one that turned out not to be real. This is NOT how a dependency ends in the normal course. A...
-
unfile_documentDestructiveRemove one Multiverse document from a thread noun. The document itself is untouched in Multiverse and the noun is untouched — only the link, its role and its reason go. Use this...
-
unlink_propositionDestructiveRemove the ASSUMES edge between a proposition and one node. Both are untouched — only the edge and the reason recorded on it go. Use this when a link was drawn in error. To say ...
-
unrelate_decisionsDestructiveRemove one typed edge between two decisions. Both decisions are untouched — only the edge goes, and only the edge with exactly this relation; a pair related two ways keeps the o...
-
transfer_work_item_between_boardsFinancialTransfer one existing card identity to a column on another operating board. This is NOT a copy and NOT a workflow promotion: the server keeps the work-item id and every item-lin...
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.