QG202 Undeclared catalogue¶
| Type | Info |
| Severity | none: it reports what the scan could not decide or describe |
| Front end | a synthesised host and its router |
| Guardrail category (Vassilev 2026) | F. Monitoring, Auditing & Logging Guardrails |
| AI RMF functions (NIST AI 100-1) | MEASURE, MANAGE |
| OWASP | none: a statement about the scan: how the router's action axis was read |
| Gates by default | no, unless the project's quality profile adds it |
Raised when¶
Axes derived from names rather than declared, or routing that needed titles.
Why it matters¶
The router's figures describe a catalogue nobody declared: what each tool does and to what was guessed from its name.
How to fix it¶
Declare the tool's action and object in the catalogue.
What the finding carries¶
A location in the document the team edits, a fingerprint that survives unrelated edits, a reproduction (a transcript replayed against NeMo Guardrails for a policy, a dialogue case played through the selector for a router, or the gate's inputs reproduced by agreement), and, where the scan can produce one, a fix whose re-scan it has already run. See the catalogue for the other rules.