The rule pages¶
The Guardrail Bug Hunter reports every way it finds through your rules as a finding under one of these rules. Each page says when the rule is raised, why it matters and how to fix it, with the rule's guardrail category, its AI RMF functions and its OWASP entries. A rule's identifier never changes meaning, so a finding you filed last year still points at the right page.
QG0xxrules are found in a policy or an agent graph.QG1xxrules are review items: security hotspots a person decides about.QG2xxrules say what a scan could not decide or could not describe.QG3xxrules are found in a host built from your catalogue and the router in front of it.
Where a rule's severity is by action, it comes from what the action can do, as your catalogue classes it: Critical for a destructive or irreversible write, High for a write, Medium for a read, and High for an action nothing classes. Chapter 28 explains how to read a finding, and chapter 39 what the categories, functions and OWASP entries are and where they come from.
| Rule | Title | Type | Severity (as published) | Guardrail category | OWASP |
|---|---|---|---|---|---|
| QG001 | Missing check | Vulnerability | by action | E | LLM03:2026, ASI02:2026 |
| QG002 | Escapable guard | Vulnerability | by action | E | LLM03:2026, ASI02:2026 |
| QG003 | Multi-turn escape | Vulnerability | by action, one level up | E | LLM03:2026, ASI03:2026 |
| QG004 | Permissive by default | Bug | Medium | B | LLM03:2026, ASI02:2026 |
| QG005 | Unshippable policy | Bug | High | B | none |
| QG006 | Unverified region | Bug | High or Low, by region | F | none |
| QG007 | Read before written | Vulnerability | Medium | B | ASI02:2026 |
| QG008 | Call without execute | Vulnerability | High | E | none |
| QG009 | Undefined bot message | Vulnerability | Medium | B | LLM07:2026, ASI09:2026 |
| QG010 | Dead action | Vulnerability | High | B | LLM03:2026 |
| QG011 | Confused deputy | Vulnerability | by action | E | LLM01:2026, LLM03:2026, ASI01:2026, ASI02:2026 |
| QG012 | Cascading injection | Vulnerability | by action | E | LLM01:2026, ASI07:2026, ASI08:2026 |
| QG013 | Irreversible before undoable | Bug | High | E | LLM03:2026, ASI08:2026 |
| QG014 | Order rule escapable | Vulnerability | by action | E | LLM03:2026, ASI02:2026 |
| QG015 | Undeclared route | Bug | Medium | B | ASI01:2026 |
| QG016 | Unmodelled path | Vulnerability | by action, at least High | E | ASI10:2026 |
| QG017 | Model writes code that runs | Vulnerability | Critical, High where sandboxed | E | LLM10:2026, LLM01:2026, ASI05:2026 |
| QG018 | Model writes a query or a destination | Vulnerability | High, Medium for a template | E | LLM10:2026, LLM01:2026 |
| QG019 | Confidential data leaves | Vulnerability | High | E | LLM02:2026, LLM08:2026 |
| QG020 | Retrieval not bound to the user | Vulnerability | High | E | LLM09:2026, LLM02:2026 |
| QG021 | Untrusted content persisted | Vulnerability | High | E | ASI06:2026, LLM01:2026 |
| QG022 | Rail with a published advisory | Vulnerability | the advisory's | B | LLM04:2026, ASI04:2026 |
| QG023 | Unbounded loop | Bug | Medium | E | LLM06:2026, ASI08:2026 |
| QG101 | Unchecked action | Security hotspot | review | B | LLM03:2026, LLM01:2026, ASI01:2026, ASI02:2026 |
| QG102 | Write reached by a slip | Security hotspot | review | E | ASI02:2026, ASI09:2026 |
| QG103 | Irreversible before compensable | Security hotspot | review | E | LLM03:2026, ASI08:2026 |
| QG104 | Check missing against its peers | Security hotspot | review | B | LLM03:2026, ASI02:2026 |
| QG105 | Unrecoverable write | Security hotspot | review | E | LLM03:2026, ASI08:2026 |
| QG106 | Unpinned tool source | Security hotspot | review | B | LLM04:2026, ASI04:2026 |
| QG107 | Unauthenticated agent channel | Security hotspot | review | B | ASI07:2026 |
| QG201 | Undecided | Info | none | F | none |
| QG202 | Undeclared catalogue | Info | none | F | none |
| QG301 | Router bypass | Vulnerability | by action | E | LLM03:2026, ASI02:2026 |
| QG302 | Unsupported argument | Vulnerability | by action | E | ASI02:2026 |
| QG303 | Platform invariant escaped | Vulnerability | by action | E | ASI03:2026 |
| QG304 | Clarification unbounded | Bug | High | B | LLM06:2026 |
| QG305 | Write read as a read | Vulnerability | Critical | E | LLM03:2026, ASI02:2026 |
| QG306 | Wrong write | Vulnerability | Critical | E | ASI02:2026 |
| QG307 | Egress through a read | Vulnerability | Critical | E | LLM02:2026 |
| QG308 | Live collision | Bug | High on a write, else Medium | B | ASI02:2026 |
| QG309 | Unroutable tool | Bug | Medium | B | none |
| QG310 | Router out of step | Bug | High | B | none |
| QG311 | Unshippable synthesis | Bug | High | B | none |
| QG312 | Engine disagreement | Bug | High | F | none |
| QG320 | Negated write runs | Vulnerability | Critical | E | LLM03:2026, ASI02:2026 |
| QG321 | Read words call a write | Vulnerability | Critical | E | LLM03:2026, ASI02:2026 |
| QG322 | Hidden egress runs | Vulnerability | Critical | E | LLM02:2026, LLM01:2026 |
| QG323 | Write outside its own words | Security hotspot | review | B | ASI02:2026 |
| QG324 | Unlabelled route to a write | Security hotspot | review | B | ASI02:2026 |