QG101 Unchecked action¶
Em inglês
Esta página de regra é mostrada como o caçador de bugs a publica, em inglês, porque é a página que cada achado cita; os identificadores, os campos e o texto da regra são os do relatório.
| Type | Security hotspot |
| Severity | none: a review item |
| Front end | a Colang policy, or its IR record |
| Guardrail category (Vassilev 2026) | B. Policy & Governance Guardrails |
| AI RMF functions (NIST AI 100-1) | MAP |
| Why these functions | the catalogue's assignment, not the article's chain (GOVERN, MAP, MANAGE): a hotspot asks a person to map whether the action needs a control; nothing is governed or managed until they decide |
| OWASP | LLM03:2026 Excessive Agency, LLM01:2026 Prompt Injection, ASI01:2026 Agent Goal Hijack, ASI02:2026 Tool Misuse and Exploitation |
| Gates by default | no, unless the project's quality profile adds it |
Raised when¶
A tool call no control guards and no obligation in the team's table covers; a bot message under no control is counted rather than raised, and a call only per-turn rails reach is labelled rather than raised.
Why it matters¶
Nothing in the rules conditions this tool call on any control, and nobody has stated what it must not run without. It may be meant to be open; it is the shape an omission takes. Where the only inputs in its cone are intents, any user turn the classifier reads as that intent reaches it and no state of the database has to cooperate. A write is raised at the action's severity, since a write any turn can trigger is the case this rule exists for.
How to fix it¶
Decide whether the call needs a control. If it does, add one, or a confirmation step before it, and a property-table row naming it; if not, accept the hotspot with the reason.
OWASP LLM03:2026, "Require user approval": where the call writes, require the user's approval before this action runs, alongside a control on the call.
What the finding carries¶
A location in the document the team edits, a fingerprint that survives unrelated edits, a reproduction (a transcript replayed against NeMo Guardrails for a policy, a dialogue case played through the selector for a router, or the gate's inputs reproduced by agreement), and, where the scan can produce one, a fix whose re-scan it has already run. See the catalogue for the other rules.