QG001 Missing check

Type	Vulnerability
Severity	by what the action can do: Critical for a destructive or irreversible write, High for a write, Medium for a read, High when no extracted model classes it
Front end	a policy and a synthesised host
Guardrail category (Vassilev 2026)	E. Action & Execution Guardrails
AI RMF functions (NIST AI 100-1)	GOVERN, MANAGE
OWASP	LLM03:2026 Excessive Agency, ASI02:2026 Tool Misuse and Exploitation
Gates by default	yes: a new finding under it fails the default quality gate

Raised when

The action is reachable and nothing in the rules relates it to the control.

Why it matters

The action can run without the control, and no route to it consults the control at all, so there is no guard to tighten: the check was never written. A conversation that reaches the action reaches it whatever the control says.

How to fix it

Add the control as a condition on every route that registers the action. The patch names the condition and the flows to put it in; a new flow cannot tighten the action, because guards on one action merge as an OR.

OWASP LLM03:2026, "Complete mediation": enforce the check in the rail, which decides from trusted state, rather than relying on the model to decide whether the action is allowed.

What the finding carries

A location in the document the team edits, a fingerprint that survives unrelated edits, a reproduction (a transcript replayed against NeMo Guardrails for a policy, a dialogue case played through the selector for a router, or the gate's inputs reproduced by agreement), and, where the scan can produce one, a fix whose re-scan it has already run. See the catalogue for the other rules.