Critical-risk tools in Meta Council
15 of the 280 tools in Meta Council are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
account_exportDestructiveExport this account's own data across every table the account owns, as the same JSON envelope the REST route returns. The set of tables served is derived from the same ownership...
-
cancel_bookingDestructiveCommit the exact owner-confirmed cancel preview using both independent scheduling grants. This can notify the recipient, including cancellation. Reuse the same preview, hash and...
-
decide_approvalDestructiveAnswer a waiting checkpoint by request id: approve, reject, or amend. 'amend' means send the step back to be redone with the change described in notes, so notes are required for...
-
delete_accounting_runDestructiveHide one owned Accounting run from normal lists and reads. Its encrypted data and provenance are retained and restore_accounting_run reverses this action; this is not permanent ...
-
delete_monitorDestructiveDelete one of your standing watches, so it stops firing. Does not touch anything it already started. Requires authentication and the monitors:write scope.
-
delete_saved_viewDestructivePermanently delete one of YOUR OWN saved views. UNRECOVERABLE -- there is no undo and the definition is not retained. archive_saved_view is the reversible retirement and is almo...
-
delete_workflow_templateDestructiveDelete a custom workflow template the caller owns. Built-in templates cannot be deleted. This removes the saved definition; runs already started from it are unaffected. Requires...
-
preview_scheduling_actionDestructiveFreeze exactly one create, reschedule or cancel proposal for ten minutes. Sending requires separate explicit authenticated owner-session confirmation plus scheduling:agent_write...
-
project_unlink_featureDestructiveRemove one exact project-feature placement, retaining the ticket. Read binding_id from project_get first; stale bindings or document references conflict. Does not delete tickets...
-
reconcile_attention_notification_deliveryDestructiveRecord an owner declaration received or cancel with a note and current expected_version. Original network outcome and recovery history remain immutable. This is an attestation, ...
-
revoke_portfolio_report_shareDestructiveRevoke future reads through an owned report link. Requires explicit reports:share; reducing access does not need another human approval. Already copied content cannot be recalle...
-
ticket_dependency_removeDestructiveStop an owned ticket from waiting on a prerequisite. Removing the last unsatisfied edge can allow this ticket to close, so this is a gate-opening action. Nothing is deleted: the...
-
void_invoiceDestructiveVoid a draft or sent invoice. Cannot be applied to an already-paid invoice (issue a credit note instead). invoice_id is required. No delete tool is exposed over MCP — void is th...
-
add_invoice_line_itemFinancialAdd a billable line item to a draft or sent invoice; totals are recomputed automatically. Blocked once paid/void. invoice_id is required.
-
mark_invoice_paidFinancialMark a draft or sent invoice as paid (stamps paid_at). Cannot be applied to a void invoice. invoice_id is required.
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.