QG103 Irreversible before compensable¶
| Type | Security hotspot |
| Severity | none: a review item |
| Front end | a synthesised host and its router |
| Guardrail category (Vassilev 2026) | E. Action & Execution Guardrails |
| AI RMF functions (NIST AI 100-1) | MAP |
| Why these functions | the catalogue's assignment, not the article's chain (GOVERN, MANAGE): a hotspot asks a person to map the order of the plan's effects; nothing is governed or managed until they decide |
| OWASP | LLM03:2026 Excessive Agency, ASI08:2026 Cascading Failures |
| Gates by default | no, unless the project's quality profile adds it |
Raised when¶
An agent can reach an irreversible write and a compensable one in one prompt.
Why it matters¶
The plan's saga names the pivot, and the confirmation for it must say that the later steps cannot undo it.
How to fix it¶
Have the host's confirmation for the pivot step say that it cannot be undone.
What the finding carries¶
A location in the document the team edits, a fingerprint that survives unrelated edits, a reproduction (a transcript replayed against NeMo Guardrails for a policy, a dialogue case played through the selector for a router, or the gate's inputs reproduced by agreement), and, where the scan can produce one, a fix whose re-scan it has already run. See the catalogue for the other rules.