High-risk tools in Meta Council
11 of the 280 tools in Meta Council are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
dismiss_ticket_integration_effectExecuteSettle one uncertain effect as owner-dismissed: you accept that its outcome stays unknown. Requires confirm true; makes no provider request and records one immutable settlement....
-
execute_saved_viewExecuteRun saved ticket, attention or reviewed-work intent against live owned data. Ordinary views return matching tickets and optional group counts. Triage returns the original reader...
-
preview_accounting_ticket_syncExecutePreview, without writing, how one completed owned Accounting run's WRITEOff work plan would map to stable Meta Council tickets. Reports creates, updates, unchanged tickets, huma...
-
project_link_featureExecuteLink an existing owned parentless epic to this project. Exact retry reuses the link; linking an epic already belonging to another project conflicts. Does not reparent, claim or ...
-
retry_workflowExecuteContinue a stalled or finished workflow run from a chosen step. This starts a NEW run that reuses the outputs the original run already recorded and only executes — and only pays...
-
review_external_workflowExecuteApprove continuation or reject an ordinary internal draft checkpoint using its review_sha as input_sha. This is not a human-only approval or permission to send. Human-only gates...
-
run_comparisonExecuteRe-run a member's workflow as it stands today and record the result as a new run. This calls model providers and costs money; it is priced and refused against your budget before...
-
run_councilExecuteSubmit a question or decision to Meta Council. A panel of specialized AI agents will independently analyze it, then a synthesis step combines their opinions into a unified recom...
-
run_workflowExecuteStart a multi-step workflow pipeline and return its session id and definition_sha immediately by default — the fingerprint of the definition this run resolved, comparable agains...
-
start_external_workflowExecuteStart a caller-executed sales evidence draft. Returns frozen instructions for your agent to execute. No server model call, tools or sending. Reuse request_id only with identical...
-
ticket_scenario_reviseExecuteReplace an owned scenario's content, compare-and-swapping on expected_version. Revisions are append-only: validation runs already recorded keep naming the exact version and hash...
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.