Critical-risk tools in Stateset
38 of the 238 tools in Stateset are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
stateset_cancel_asnDestructiveCancels an ASN. Use when the shipment is cancelled or the ASN was created in error.
-
stateset_cancel_orderDestructiveCancels an order. Use when a customer requests cancellation or order cannot be fulfilled. The order must not already be shipped. Optionally provide a reason for the cancellation.
-
stateset_cancel_purchase_orderDestructiveCancels a purchase order. Only works for POs not yet received. Optionally provide a cancellation reason.
-
stateset_cancel_work_orderDestructiveCancels a work order. Use when the work is no longer needed or the associated order has been cancelled.
-
stateset_clear_cacheDestructiveClears cached data to force fresh API calls. Use after making changes that aren
-
stateset_clear_cartDestructiveRemoves all items from a cart. Use when customer wants to start over with an empty cart.
-
stateset_delete_asnDestructiveDeletes an ASN record
-
stateset_delete_bill_of_materialsDestructiveDeletes a bill of materials record
-
stateset_delete_cartDestructiveDeletes a cart. Use when a cart is abandoned or customer starts over. This action is permanent.
-
stateset_delete_cash_saleDestructiveDeletes a cash sale record
-
stateset_delete_customerDestructiveDeletes a customer record
-
stateset_delete_fulfillment_orderDestructiveDeletes a fulfillment order record
-
stateset_delete_inventoryDestructiveDeletes an inventory record
-
stateset_delete_invoiceDestructiveDeletes an invoice record
-
stateset_delete_item_receiptDestructiveDeletes an item receipt record
-
stateset_delete_manufacturer_orderDestructiveDeletes a manufacturer order record
-
stateset_delete_notificationDestructiveDeletes a notification. Permanently removes the notification from the user\
-
stateset_delete_orderDestructiveDeletes an order record
-
stateset_delete_paymentDestructiveDeletes a payment record
-
stateset_delete_productDestructiveDeletes a product record
-
stateset_delete_product_variantDestructiveDeletes a product variant. WARNING: This may affect existing orders referencing this variant. Consider deactivating instead.
-
stateset_delete_purchase_orderDestructiveDeletes a purchase order record
-
stateset_delete_rmaDestructiveDeletes an RMA record
-
stateset_delete_robot_serialDestructiveDeletes a robot serial record. WARNING: Only delete records created in error. Deployed units should not be deleted.
-
stateset_delete_sales_orderDestructiveDeletes a sales order record
-
stateset_delete_shipmentDestructiveDeletes a shipment record
-
stateset_delete_supplierDestructiveDeletes a supplier record. WARNING: May affect existing purchase orders. Consider deactivating instead.
-
stateset_delete_userDestructiveDeletes a user account. WARNING: This is permanent. Consider deactivating instead if the user may need to be restored.
-
stateset_delete_warrantyDestructiveDeletes a warranty record
-
stateset_delete_work_orderDestructiveDeletes a work order record
-
stateset_remove_bom_componentDestructiveRemoves a component from a Bill of Materials. Use when a component is no longer needed in the product structure.
-
stateset_remove_cart_itemDestructiveRemoves an item from the cart entirely. Use when customer decides not to purchase a specific item.
-
stateset_remove_componentDestructiveRecords removal of a component from a robot. Specify reason for removal (replacement, failure, upgrade).
-
stateset_complete_checkoutFinancialCompletes the checkout and creates an order. Processes payment and initiates fulfillment. Returns the created order ID.
-
stateset_create_agentic_checkoutFinancialCreates an AI-powered agentic checkout session. Enables natural language interaction for checkout. Optionally link to existing customer.
-
stateset_create_cash_saleFinancialCreates a cash sale record
-
stateset_create_paymentFinancialCreates a payment record
-
stateset_refund_paymentFinancialProcesses a refund for a payment. Specify the amount to refund and the reason. Partial refunds are supported.
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.