QG002 Escapable guard

Em inglês

Esta página de regra é mostrada como o caçador de bugs a publica, em inglês, porque é a página que cada achado cita; os identificadores, os campos e o texto da regra são os do relatório.

Type	Vulnerability
Severity	by what the action can do: Critical for a destructive or irreversible write, High for a write, Medium for a read, High when no extracted model classes it
Front end	a policy and a synthesised host
Guardrail category (Vassilev 2026)	E. Action & Execution Guardrails
AI RMF functions (NIST AI 100-1)	GOVERN, MANAGE
OWASP	LLM03:2026 Excessive Agency, ASI02:2026 Tool Misuse and Exploitation
Gates by default	yes: a new finding under it fails the default quality gate

Raised when

The rules gate the action on the control, and a path gets past it.

Why it matters

The check exists and something else satisfies the guard without it: a second flow that reaches the same action, a branch that falls through. The policy reads as guarded and is not. An or the policy writes is one obligation -- the action with every alternative false -- so it is raised only where a route gets past all of them, and names the term.

How to fix it

Apply the patch inside every flow it names. It is the smallest condition that closes the path, and its over-blocking check says whether it removes anything the control permits.

OWASP LLM03:2026, "Complete mediation": enforce the check in the rail, which decides from trusted state, rather than relying on the model to decide whether the action is allowed.

What the finding carries

A location in the document the team edits, a fingerprint that survives unrelated edits, a reproduction (a transcript replayed against NeMo Guardrails for a policy, a dialogue case played through the selector for a router, or the gate's inputs reproduced by agreement), and, where the scan can produce one, a fix whose re-scan it has already run. See the catalogue for the other rules.