QG003 Multi-turn escape

Em inglês

Esta página de regra é mostrada como o caçador de bugs a publica, em inglês, porque é a página que cada achado cita; os identificadores, os campos e o texto da regra são os do relatório.

Type	Vulnerability
Severity	one level above what the action can do: the class the team is least likely to have tested
Front end	a Colang policy, or its IR record
Guardrail category (Vassilev 2026)	E. Action & Execution Guardrails
AI RMF functions (NIST AI 100-1)	GOVERN, MANAGE
OWASP	LLM03:2026 Excessive Agency, ASI03:2026 Identity and Privilege Abuse
Gates by default	yes: a new finding under it fails the default quality gate

Raised when

The obligation holds at one turn and fails at the declared conversation depth.

Why it matters

A check read once and relied on later: an approval given at one step is spent at another. Single-turn testing cannot see it, which is why it ranks a level above its one-turn equivalent.

How to fix it

Bind the control to the step that uses it -- read it in the same turn as the action, or carry it with the call it approved -- and re-scan at the same depth.

What the finding carries

A location in the document the team edits, a fingerprint that survives unrelated edits, a reproduction (a transcript replayed against NeMo Guardrails for a policy, a dialogue case played through the selector for a router, or the gate's inputs reproduced by agreement), and, where the scan can produce one, a fix whose re-scan it has already run. See the catalogue for the other rules.