removeMemberFromRole · MCP Mingdao MCP: Risk & Policy

WHAT IT DOES

What removeMemberFromRole does on MCP Mingdao

AI agents call removeMemberFromRole to permanently remove resources in MCP Mingdao — typically in cleanup and lifecycle workflows. It does its job in a single call, and there is no undo.

WHY IT NEEDS A POLICY

Why removeMemberFromRole needs a policy

Removing a member from a role revokes their permissions/access. While the member record itself isn't deleted, the role association is removed and may not be easily recoverable, making this closer to Destructive than Write. Misuse could inadvertently strip access from legitimate users.

From the tool's definition removeMemberFromRole / 移出角色下成员 — removes a member from a role, which is an irreversible membership removal action

Attacks that exploit this kind of access

Questions about removeMemberFromRole

What does the removeMemberFromRole tool do? +

移出角色下成员. It is categorised as a Destructive tool in the MCP Mingdao MCP Server, which means it can permanently delete or destroy data. Block by default and require explicit approval.

How do I enforce a policy on removeMemberFromRole? +

Register the MCP Mingdao MCP server in PolicyLayer and add a rule for removeMemberFromRole: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches MCP Mingdao. Nothing to install.

What risk level is removeMemberFromRole? +

removeMemberFromRole is a Destructive tool with critical risk. Critical-risk tools should be blocked by default and only enabled with explicit human approval.

Can I rate-limit removeMemberFromRole? +

Yes. Add a rate_limit block to the removeMemberFromRole rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block removeMemberFromRole completely? +

Set action: deny in the PolicyLayer policy for removeMemberFromRole. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides removeMemberFromRole? +

removeMemberFromRole is provided by the MCP Mingdao MCP server (mingdaocloud/mcp-mingdao). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.