tools / agent audit / rules / deletes without an approval step · v0.1.0 · View source · Edit on GitHub
Agent audit rule · v0.1.0
Deletes without an approval step
The agent can delete data (or the tool says it is destructive) with no human confirming it. A bulk delete is high. Without a manifest the spec cannot show an approval that may exist in code, so this is reported one level lower.
- medium base severity
- 4 test fixtures
medium destructive-no-approval
Flagged
// tools.json
1 [
2 {
3 > "name": "delete_document",
4 "input_schema": {
5 "type": "object",Fix
Require a confirmation before deletes, prefer soft delete, and declare the step in the manifest (`approvals: ["delete_*"]`).
Fine
// tools.json
[
{
"name": "delete_document",
"input_schema": {
"type": "object",
"properties": {}
}
}
]
// agent.json
{
"agent": {
"name": "Docs bot"
},
"approvals": [
"delete_*"
]
}