QG007 Read before written

Em inglês

Esta página de regra é mostrada como o caçador de bugs a publica, em inglês, porque é a página que cada achado cita; os identificadores, os campos e o texto da regra são os do relatório.

Type	Vulnerability
Severity	Medium
Front end	a Colang policy
Guardrail category (Vassilev 2026)	B. Policy & Governance Guardrails
AI RMF functions (NIST AI 100-1)	MAP, MEASURE
Why these functions	the catalogue's assignment, not the article's chain (GOVERN, MAP, MANAGE): a branch reading a variable nothing has set is found by mapping the policy's data flow and measuring the branch it takes; no governance decision is missing
OWASP	ASI02:2026 Tool Misuse and Exploitation
Gates by default	no, unless the project's quality profile adds it

Raised when

A condition reads a variable that only its own branches set, from another variable.

Why it matters

The test decides whether the variable is set, from a value nothing has set yet: it reads whatever the context holds, usually nothing, so one branch is taken every time and the value the author meant to test is never consulted.

How to fix it

Test the variable the branch reads from, not the one it writes to, and re-scan.

What the finding carries

A location in the document the team edits, a fingerprint that survives unrelated edits, a reproduction (a transcript replayed against NeMo Guardrails for a policy, a dialogue case played through the selector for a router, or the gate's inputs reproduced by agreement), and, where the scan can produce one, a fix whose re-scan it has already run. See the catalogue for the other rules.