QG013 Irreversible before undoable¶
| Type | Bug |
| Severity | High |
| Front end | an agent graph, and a Colang policy where its actions map to the catalogue's tools |
| Guardrail category (Vassilev 2026) | E. Action & Execution Guardrails |
| AI RMF functions (NIST AI 100-1) | MAP, MANAGE |
| Why these functions | the catalogue's assignment, not the article's chain (GOVERN, MANAGE): the defect is in the order of effects on a path, which is mapped and then managed by reordering or confirming; no governance rule is missing |
| OWASP | LLM03:2026 Excessive Agency, ASI08:2026 Cascading Failures |
| Gates by default | no, unless the project's quality profile adds it |
Raised when¶
A compensable write can run after an irreversible one on a path, without the irreversible step's confirmation having said so.
Why it matters¶
If a later step fails, the run is rolled back -- and the irreversible step stays done while the steps after it are undone. A person approving the irreversible step was not told the later ones could not undo it.
How to fix it¶
Move the irreversible step last, or bind it to the guarded tool node so its confirmation says that the later steps cannot undo it.
OWASP entries¶
LLM03:2026 Excessive Agency (autonomy), ASI08 Cascading Failures, from the OWASP Top 10 for LLM Applications 2026 and for Agentic Applications 2026. The
mapping holds because this is it lets a decision run past the point a person can undo it. A finding under a rule mapped to LLM03:2026 carries the
root cause in brackets as owasp_root_cause.
What the finding carries¶
A location at the node's source -- the file and line of its callable, or the line of agent.yaml that
declared it -- falling back to the export's JSON Pointer; a fingerprint over the rule, the tool, the
control, the node and a digest of the node's declaration, so moving unrelated nodes keeps it and changing
the node's tools or edges makes a new one; the witness as a path through the graph; and a structural fix.
A graph finding is replayed in the team's environment, with every tool stubbed and a scripted model making
the witness's choices; until then it reads not yet replayed. See the catalogue for the other rules.