QG005 Unshippable policy¶
| Type | Bug |
| Severity | High |
| Front end | a Colang policy, or its IR record |
| Guardrail category (Vassilev 2026) | B. Policy & Governance Guardrails |
| AI RMF functions (NIST AI 100-1) | GOVERN, MAP, MANAGE |
| OWASP | none: the file cannot be deployed as written; a defect of the policy's build, not a risk OWASP lists |
| Gates by default | yes: a new finding under it fails the default quality gate |
Raised when¶
The compiler reports a defect that makes the policy unshippable.
Why it matters¶
The circuit is faithful and the file is the problem: for instance one tool action registered from two flows, whose guards merge as an OR so the weaker route decides whether the side effect happens.
How to fix it¶
Fix the defect the compiler names at its line, then re-scan.
What the finding carries¶
A location in the document the team edits, a fingerprint that survives unrelated edits, a reproduction (a transcript replayed against NeMo Guardrails for a policy, a dialogue case played through the selector for a router, or the gate's inputs reproduced by agreement), and, where the scan can produce one, a fix whose re-scan it has already run. See the catalogue for the other rules.