QG105 Unrecoverable write¶
Em inglês
Esta página de regra é mostrada como o caçador de bugs a publica, em inglês, porque é a página que cada achado cita; os identificadores, os campos e o texto da regra são os do relatório.
| Type | Security hotspot |
| Severity | review |
| Front end | an agent graph, and a Colang policy where its actions map to the catalogue's tools |
| Guardrail category (Vassilev 2026) | E. Action & Execution Guardrails |
| AI RMF functions (NIST AI 100-1) | MAP, MANAGE |
| Why these functions | the catalogue's assignment, not the article's chain (GOVERN, MANAGE): the write's recoverability is mapped and then managed by declaring a compensation or marking it irreversible; no governance rule is missing |
| OWASP | LLM03:2026 Excessive Agency, ASI08:2026 Cascading Failures |
| Gates by default | no, unless the project's quality profile adds it |
Raised when¶
A write with no compensation, not marked irreversible, on a path with another write.
Why it matters¶
A run that fails after this write cannot undo it, and nothing says it cannot be undone, so a rollback leaves it in place without telling anyone.
How to fix it¶
Declare the tool's compensation in the catalogue, or mark it irreversible so a person confirms it knowing so.
OWASP entries¶
ASI08 Cascading Failures, from the OWASP Top 10 for LLM Applications 2026 and for Agentic Applications 2026. The
mapping holds because this is a write a failure leaves in place. A finding under a rule mapped to LLM03:2026 carries the
root cause in brackets as owasp_root_cause.
What the finding carries¶
A location at the node's source -- the file and line of its callable, or the line of agent.yaml that
declared it -- falling back to the export's JSON Pointer; a fingerprint over the rule, the tool, the
control, the node and a digest of the node's declaration, so moving unrelated nodes keeps it and changing
the node's tools or edges makes a new one; the witness as a path through the graph; and a structural fix.
A graph finding is replayed in the team's environment, with every tool stubbed and a scripted model making
the witness's choices; until then it reads not yet replayed. See the catalogue for the other rules.