# delegateToAgent

Hand an organisation agent a brief (a piece of work, big or small) and get its job back. The job runs in the background, in steps, and this call waits for it for up to waitSeconds (default 20, at most 45): a job that settles in time comes back with its outcome and, once finished, its receipt (a short summary, counts of what changed, links, issues that need a person); otherwise you get status: running (or queued), progress and pollAfterSeconds, and you follow it with getAgentRun. Changes that must wait at the run's approval level (approvalMode, else the agent's own level) land in the approvals inbox and in pendingApprovals; decide them with approveAgentAction. Pass the same idempotencyKey when you retry. A job that reaches its budget (model steps, tool calls, tokens or 30 minutes of work) pauses with a summary of what is done and left: continue it, with a fresh budget, by calling delegateToAgent with continueRunId (no brief needed). A job whose requester loses access to what it needs pauses as rights_changed. Plan mode: with mode: plan, or at confirm and confirm_destructive when the job would make more than five changes or delete anything, the agent first drafts the complete change set (reads run, nothing changes) and the job waits for ONE approval of the whole plan: pendingApprovals holds it with the counts, any tool fees and the first steps, and getAgentRun plan pages every step with its preview. Approving runs exactly those steps, in order, with no model in between. If an item a step changes was edited after the plan was drafted, the job pauses as conflict naming it; continuing the job re-plans the remaining steps as a new plan that needs its own approval. Undo: pass undoRunId (no brief needed) to undo a finished job. The undo is a job of its own, acting for you: the agent builds the compensating plan from what the job journaled (restore each edited document to its version before the job, move items back, put fields back, delete what the job created) and it waits for ONE approval like any plan. An item changed since the job is skipped, never overwritten, and the plan lists what cannot be undone (permanent deletes, effects outside Stable Baseline such as a meeting bot, and tool fees already charged, which stay charged). The job's requester, the agent's owner and its managers may undo it; getAgentRun undo says whether you may now.

Agent View of the PolicyLayer registry record for `delegateToAgent`. HTML page: https://policylayer.com/tools/io-stablebaseline-sb/delegatetoagent

## Facts

- Tool: `delegateToAgent`
- Server: Stable Baseline (`https://api.stablebaseline.io/functions/v1/cloud-serve/mcp`) — https://policylayer.com/tools/io-stablebaseline-sb.md
- Homepage: https://github.com/stablebaseline/mcp
- Risk category: Destructive (Critical risk)
- Registry record: grade F, identity unverified
- Server auth posture: open
- Server CORS policy: https://app.stablebaseline.io
- Server rate-limited: no
- Parameters: 8 (1 required)
- Recommended policy verdict: Hidden

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `mode` | string | no | Optional. `plan`: draft the complete change set first and put it to one approval before anything changes, at any approval level. `auto` (the default): a job at |
| `brief` | string | no | What the agent should do, in plain language. Required unless continueRunId is given. |
| `agentId` | string | yes | The agent's id, or its exact name (see listAgents). |
| `undoRunId` | string | no | Optional. Undo this FINISHED job of the same agent (completed, failed or cancelled) instead of starting a new one. Answers the undo job: its compensating plan w |
| `waitSeconds` | number | no | Optional. How long this call waits for the job before it answers with the job's progress: 0 to 45 seconds, default 20. 0 answers at once. |
| `approvalMode` | string | no | Optional. The approval level for this run only. Omit it to use the agent's own level (`behaviour` in listAgents, `confirm` unless its managers chose otherwise). |
| `continueRunId` | string | no | Optional. Continue this PAUSED job of the same agent with a fresh budget instead of starting a new one. The person who started it, the agent's owner and its man |
| `idempotencyKey` | string | no | Optional. Any string of up to 200 characters that identifies this request. The same agent, the same key and the same brief within 24 hours return the job the fi |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "delegateToAgent",
    "arguments": {
      "agentId": "<agentId>"
    }
  }
}
```

## Why delegateToAgent is rated Critical

An AI agent that decides to call delegateToAgent doesn't hesitate, doesn't double-check, and doesn't stop at one. Whatever it removes from Stable Baseline is gone. There is no undo for destructive operations.

Risk signals: Bulk/mass operation — affects multiple targets

## Use case

AI agents call delegateToAgent to permanently remove resources in Stable Baseline, typically in cleanup and lifecycle workflows. It does its job in a single call, and there is no undo.

## Recommended policy (PolicyLayer)

Verdict: **Hidden**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Stable Baseline:

```json
{
  "version": "1",
  "default": "deny",
  "hide": [
    "delegateToAgent"
  ]
}
```

## Other tools on Stable Baseline (221)

- `autoDesignWhiteboard` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/autodesignwhiteboard.md
- `cancelAllKgInScope` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/cancelallkginscope.md
- `cancelKgBuildBatch` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/cancelkgbuildbatch.md
- `deleteDatabase` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletedatabase.md
- `deleteDatabaseRows` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletedatabaserows.md
- `deleteDiagramInDocument` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletediagramindocument.md
- `deleteDocument` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletedocument.md
- `deleteFolder` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletefolder.md
- `deleteImageInDocument` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteimageindocument.md
- `deleteImprovement` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteimprovement.md
- `deleteImprovementCategory` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteimprovementcategory.md
- `deleteImprovementComment` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteimprovementcomment.md
- `deletePlan` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteplan.md
- `deletePlanComment` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteplancomment.md
- `deletePlanPhase` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteplanphase.md
- `deleteResourcePermission` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteresourcepermission.md
- `deleteTaskDependency` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletetaskdependency.md
- `deleteTeam` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteteam.md
- `deleteVegaDataFile` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletevegadatafile.md
- `deleteWhiteboard` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletewhiteboard.md
- `getAgentRun` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/getagentrun.md
- `previewKgScopeChange` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/previewkgscopechange.md
- `previewSubscriptionChange` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/previewsubscriptionchange.md
- `removeMember` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/removemember.md
- `removeTeamMember` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/removeteammember.md
- `removeWorkspaceMember` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/removeworkspacemember.md
- `reorderDocuments` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/reorderdocuments.md
- `resetDocumentInBrain` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/resetdocumentinbrain.md
- `revokeTeamWorkspaceAccess` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/revoketeamworkspaceaccess.md
- `designDeckInWhiteboard` — Execute — https://policylayer.com/tools/io-stablebaseline-sb/designdeckinwhiteboard.md
- …and 191 more: https://policylayer.com/tools/io-stablebaseline-sb.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-stablebaseline-sb · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-stablebaseline-sb