Critical-risk tools in Stable Baseline
36 of the 222 tools in Stable Baseline are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
autoDesignWhiteboardDestructiveAuto-design a complete, visually polished whiteboard from a natural-language goal using the PREMIUM multi-agent pipeline (the same one the in-app assistant uses): it browses the...
-
cancelAllKgInScopeDestructiveEmergency stop for KG ingestion: cancels queued/running build runs, queued/running rebuild batches, demotes still-eager unfinished chunks. Optionally narrowed to one project. Re...
-
cancelKgBuildBatchDestructiveCancel a single KG rebuild batch. Queued runs flip to 'cancelled' immediately; running runs finish naturally. Requires can_manage_kg. Rate limit 5/min.
-
delegateToAgentDestructiveHand an organisation agent a brief (a piece of work, big or small) and get its job back. The job runs in the background, in steps, and this call waits for it for up to `waitSeco...
-
deleteDatabaseDestructiveMove a whole database, one of its tables (pass table) or one of its dashboards (pass dashboard) to the trash. It can be restored in the app for 30 days, after which it is gone f...
-
deleteDatabaseRowsDestructiveMove rows of a table to the trash: up to 500 by id, or every row that matches. Call getDatabase with table first for the field names where takes. They can be restored in the app...
-
deleteDiagramInDocumentDestructiveDelete a diagram: removes the database record AND every reference to it in the document body — the current marker format plus legacy forms (markers without an embedded diagramId...
-
deleteDocumentDestructiveDelete a document.
-
deleteFolderDestructiveDelete a folder recursively, including all nested folders and documents.
-
deleteImageInDocumentDestructiveDelete an image: removes the stored file, the database record, AND the image from the document body — both the IMAGE marker in the markdown and the image node in the document's ...
-
deleteImprovementDestructiveDelete an improvement and all associated evidence and activity.
-
deleteImprovementCategoryDestructiveDelete an improvement category. Cannot delete system categories.
-
deleteImprovementCommentDestructiveDelete a comment from an improvement. Only its author, or an admin of the improvement's project, workspace or organisation, can delete it.
-
deletePlanDestructiveDelete a plan, all its phases, and all tasks/improvements within it. This is a destructive operation that cannot be undone.
-
deletePlanCommentDestructiveDelete a comment from a plan. Only its author, or an admin of the plan's project, workspace or organisation, can delete it.
-
deletePlanPhaseDestructiveDelete a plan phase and all tasks/improvements within it. This is a destructive operation that cannot be undone.
-
deleteResourcePermissionDestructiveDelete a permission grant. Refuses if it is the LAST admin grant on the resource. Rate limit 30/min. Use when the user asks to revoke access, remove access, take away access, un...
-
deleteTaskDependencyDestructiveRemove a task-dependency edge. Neither item's dates are changed. Needs the same 'write' plan permission as createTaskDependency, so an actor that can draw an edge can also undo ...
-
deleteTeamDestructiveDelete a team. Cascades: team members and team-granted resource permissions are removed automatically. Destructive; rate limit 5/min.
-
deleteVegaDataFileDestructiveDelete a data file attachment from a document.
-
deleteWhiteboardDestructiveDelete a whiteboard (the host document and its canvas).
-
getAgentRunDestructiveFollow an agent job: its status (`queued`, `running`, `awaiting_approval`, `paused`, `completed`, `failed` or `cancelled`), `progress` (steps done, tool calls, the current tool,...
-
previewKgScopeChangeDestructivePreview the credit cost, source counts, and ETA of including or excluding KG scope rows. Returns confirmation_token (10-min TTL) plus delta of newly-in-scope vs newly-out-of-sco...
-
previewSubscriptionChangeDestructivePreview a subscription tier or seat change. Returns confirmation_token (10-min TTL) plus proration and next-invoice maths. Cross-tier upgrades from Free return requires_checkout...
-
removeMemberDestructiveHard-remove a member from an organisation, cascading to workspace and team memberships and resource permissions. Refuses self-removal and last-owner removal. The paid seat count...
-
removeTeamMemberDestructiveRemove a user from a team. Idempotent — returns removed=false if not on the team.
-
removeWorkspaceMemberDestructiveRemove a member from a workspace. Caller must be a workspace owner or admin. Refuses to remove the last remaining workspace owner.
-
reorderDocumentsDestructiveMOVE documents and boards between folders, or into another project of the organisation, and reorder them: the batch filing tool. Pass items [{documentId, folderId?, position?}, ...
-
resetDocumentInBrainDestructiveWipe + re-ingest a single document in the KG. Drops chunks/mentions/entities, clears pending lazy-extraction, and enqueues a fresh extract pass. Requires can_manage_kg + documen...
-
revokeTeamWorkspaceAccessDestructiveRevoke a team's workspace access. Idempotent — returns revoked=false if no grant exists.
-
applySubscriptionChangeFinancialApply a previously previewed subscription change. Same-tier seat changes update Stripe in place; cross-tier upgrades from Free return a hosted Checkout URL. Refuses target=free ...
-
cancelSubscriptionFinancialApply a previewed soft cancellation (cancel_at_period_end=true). Customer keeps full access until period end. Rate limit 5/h. Use only AFTER previewSubscriptionCancellation and ...
-
getCustomerPortalLinkFinancialMint a single-use Stripe Customer Portal URL for self-serve billing changes. return_url defaults to https://app.stablebaseline.io/settings/billing and must be on a stablebaselin...
-
previewSubscriptionCancellationFinancialPreview the consequences of cancelling. Returns confirmation_token plus summary {remaining_credits, prepaid_days, prepaid_value_aud, feature_loss[], at_risk_seats}. Soft cancel ...
-
purchaseCreditPackageFinancialApply a credit-package quote by creating a hosted Stripe Checkout session. Returns checkout_url + session_id. Refuses if catalogued price has drifted. Rate limit 5/h. Use only A...
-
reactivateSubscriptionFinancialReactivate a subscription that was scheduled to cancel at period end (clears cancel_at_period_end). Rate limit 5/h. Use when the user asks to reactivate, uncancel, restore, or k...
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.