QG020 Retrieval not bound to the user¶
| Type | Vulnerability |
| Severity | High |
| Front end | a Colang 1 policy with a catalogue, a Colang 2 policy, an agent graph, and a router's plan |
| Guardrail category (Vassilev 2026) | E. Action & Execution Guardrails |
| AI RMF functions (NIST AI 100-1) | MAP, MEASURE, MANAGE |
| Why these functions | the catalogue's assignment, not the article's chain (GOVERN, MANAGE): the flow is mapped from the team's declarations, measured by a reachability question and managed by the fix; no governance rule is in question |
| OWASP | LLM09:2026 Vector and Embedding Weaknesses, LLM02:2026 Sensitive Information Disclosure |
| Gates by default | yes |
Raised when¶
A retrieval from a store declared multi-tenant can run with its scope argument not taken from the authenticated principal.
Why it matters¶
The store holds more than one tenant's records, and the argument that says whose records to search is written by the model or the user rather than by the host: one tenant can read another's. The hunter decides how the retrieval is scoped, not how the store enforces the scope it is given.
How to fix it¶
Take the scope argument from the host's context -- the authenticated tenant or user -- and declare it as the retrieval's scope_argument. The fix is re-scanned.
OWASP LLM09:2026, least privilege and permission-aware retrieval: scope every retrieval from a shared store by the authenticated principal.
OWASP entries¶
LLM09:2026 Vector and Embedding Weaknesses and LLM02:2026 Sensitive Information Disclosure, from the OWASP Top 10 for LLM Applications 2026 and for Agentic Applications 2026. The
mapping holds because a retrieval scoped by anything but the authenticated principal is the policy's part of cross-tenant leakage from a shared store. The coverage is at the policy level: the rule decides the part of the risk the policy and its catalogue control, and a scan with no finding under it says that and no more.
What the finding carries¶
A location at the call site; a fingerprint over the rule, the tool, the argument or label and a digest of the flow or node; the witness as a path, naming the origin chain or the label and the absent confirmation; and a fix that is re-scanned and marked verified. A Colang finding is replayed against NeMo Guardrails; a graph finding in the team's environment with stub tools. The replay confirms the tool is called on the witness's path; the origin, label or scope that makes the call a finding is the static model's, and the finding says so. A retrieval with no scope argument over a multi-tenant store is raised without a solve, at the tool. The rule fires only on a declaration the team made in the catalogue, agent.yaml or the configuration; a missing declaration raises nothing, and the scan summary lists the rule as having had nothing to read. See the catalogue for the other rules.