Critical-risk tools in Stable Baseline
28 of the 184 tools in Stable Baseline are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
acceptTaskDependencyReviewDestructivePer-item: apply a successor's `suggested_start_date`/`suggested_end_date` to its real dates and clear `needs_dependency_review`. For a whole-plan cascade use `applyTaskDependenc...
-
cancelAllKgInScopeDestructiveEmergency stop for KG ingestion: cancels queued/running build runs, queued/running rebuild batches, demotes still-eager unfinished chunks. Optionally narrowed to one project. Re...
-
cancelInvitationDestructiveCancel a pending invitation by id. Sets status='revoked'. Server resolves the organisation_id from the invitation row; the credential must match that org AND hold can_manage_mem...
-
cancelKgBuildBatchDestructiveCancel a single KG rebuild batch. Queued runs flip to 'cancelled' immediately; running runs finish naturally. Requires can_manage_kg. Rate limit 5/min.
-
cancelSubscriptionDestructiveApply a previewed soft cancellation (cancel_at_period_end=true). Customer keeps full access until period end. Rate limit 5/h. Use only AFTER previewSubscriptionCancellation and ...
-
deleteDiagramInDocumentDestructiveDelete a diagram from a document.
-
deleteDocumentDestructiveDelete a document.
-
deleteFolderDestructiveDelete a folder recursively, including all nested folders and documents.
-
deleteImageInDocumentDestructiveDelete an image from a document and storage.
-
deleteImprovementDestructiveDelete an improvement and all associated evidence and activity.
-
deleteImprovementCategoryDestructiveDelete an improvement category. Cannot delete system categories.
-
deleteImprovementCommentDestructiveDelete a comment from an improvement.
-
deletePlanDestructiveDelete a plan, all its phases, and all tasks/improvements within it. This is a destructive operation that cannot be undone.
-
deletePlanCommentDestructiveDelete a comment from a plan.
-
deletePlanPhaseDestructiveDelete a plan phase and all tasks/improvements within it. This is a destructive operation that cannot be undone.
-
deleteResourcePermissionDestructiveDelete a resource_permissions row. Refuses if the row is the LAST admin grant on the resource. Rate limit 30/min. Use when the user asks to revoke access, remove access, take aw...
-
deleteTaskDependencyDestructiveRemove a task-dependency edge. Neither item's dates are changed.
-
deleteTeamDestructiveDelete a team. Cascades: team members and team-granted resource permissions are removed automatically. Destructive; rate limit 5/min.
-
deleteVegaDataFileDestructiveDelete a data file attachment from a document.
-
deleteWhiteboardDestructiveDelete a whiteboard (the host document and its canvas).
-
dismissTaskDependencyReviewDestructivePer-item: clear `needs_dependency_review` without changing dates — keeps the edge, ignores the suggestion. Use when the successor should stay put despite the predecessor shifting.
-
previewSubscriptionCancellationDestructivePreview the consequences of cancelling. Returns confirmation_token plus summary {remaining_credits, prepaid_days, prepaid_value_aud, feature_loss[], at_risk_seats}. Soft cancel ...
-
reactivateSubscriptionDestructiveReactivate a subscription that was scheduled to cancel at period end (clears cancel_at_period_end). Rate limit 5/h. Use when the user asks to reactivate, uncancel, restore, or k...
-
removeMemberDestructiveHard-remove a member from an organisation, cascading to workspace and team memberships and resource permissions. Refuses self-removal and last-owner removal. Stripe seat downgra...
-
removeTeamMemberDestructiveRemove a user from a team. Idempotent — returns removed=false if not on the team.
-
removeWorkspaceMemberDestructiveRemove a member from a workspace. Caller must be a workspace owner or admin. Refuses to remove the last remaining workspace owner.
-
resetDocumentInBrainDestructiveWipe + re-ingest a single document in the KG. Drops chunks/mentions/entities, clears pending lazy-extraction, and enqueues a fresh extract pass. Requires can_manage_kg + documen...
-
revokeTeamWorkspaceAccessDestructiveRevoke a team's workspace access. Idempotent — returns revoked=false if no grant exists.
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.