QG019 Confidential data leaves¶
Em inglês
Esta página de regra é mostrada como o caçador de bugs a publica, em inglês, porque é a página que cada achado cita; os identificadores, os campos e o texto da regra são os do relatório.
| Type | Vulnerability |
| Severity | High |
| Front end | a Colang 1 policy with a catalogue, a Colang 2 policy and an agent graph |
| Guardrail category (Vassilev 2026) | E. Action & Execution Guardrails |
| AI RMF functions (NIST AI 100-1) | MAP, MEASURE, MANAGE |
| Why these functions | the catalogue's assignment, not the article's chain (GOVERN, MANAGE): the flow is mapped from the team's declarations, measured by a reachability question and managed by the fix; no governance rule is in question |
| OWASP | LLM02:2026 Sensitive Information Disclosure, LLM08:2026 Hidden Context Exposure |
| Gates by default | yes |
Raised when¶
A value read from a tool the catalogue marks confidential can reach an egress tool with no confirmation, or the reply where its audience forbids it.
Why it matters¶
A record the catalogue says is for its subject, or for nobody outside the company, leaves the agent: in a message, a request, or a reply to someone it is not about. The hunter decides this through the tool calls and replies the policy routes, not what the model may say from its context in other words.
How to fix it¶
Confirm the egress call; take the read's subject argument from the authenticated principal in the host's context; or remove the confidential fields from the context before the reply. The fix is re-scanned.
OWASP LLM02:2026, require the user's approval: have a person confirm a confidential value leaving through a tool, after binding the read to its subject.
OWASP entries¶
LLM02:2026 Sensitive Information Disclosure and LLM08:2026 Hidden Context Exposure, from the OWASP Top 10 for LLM Applications 2026 and for Agentic Applications 2026. The
mapping holds because a confidential record leaves through a channel its audience does not allow; LLM08:2026 applies where the source is a retrieval or a store read placed before the model. The coverage is at the policy level: the rule decides the part of the risk the policy and its catalogue control, and a scan with no finding under it says that and no more.
What the finding carries¶
A location at the call site; a fingerprint over the rule, the tool, the argument or label and a digest of the flow or node; the witness as a path, naming the origin chain or the label and the absent confirmation; and a fix that is re-scanned and marked verified. A Colang finding is replayed against NeMo Guardrails; a graph finding in the team's environment with stub tools. The replay confirms the tool is called on the witness's path; the origin, label or scope that makes the call a finding is the static model's, and the finding says so. The rule fires only on a declaration the team made in the catalogue, agent.yaml or the configuration; a missing declaration raises nothing, and the scan summary lists the rule as having had nothing to read. See the catalogue for the other rules.