QG320 Negated write runs¶
| Type | Vulnerability |
| Severity | Critical |
| Front end | a synthesised host and its router |
| Guardrail category (Vassilev 2026) | E. Action & Execution Guardrails |
| AI RMF functions (NIST AI 100-1) | MEASURE, MANAGE |
| Why these functions | the catalogue's assignment, not the article's chain (GOVERN, MANAGE): found by measuring the router against adversarial wording and managed by the fix; the check the category governs exists, and it is what was measured |
| OWASP | LLM03:2026 Excessive Agency, ASI02:2026 Tool Misuse and Exploitation |
| Gates by default | yes: a new finding under it fails the default quality gate |
Raised when¶
A wording in a negated frame resolves to a write with no question, or a plan runs a write step read from a negated instruction.
Why it matters¶
The user said not to, and the write runs.
How to fix it¶
Change the host vocabulary row in the wording's rewrite chain. Where the chain holds no host row, the defect is the reader's and is reported to us as well.
What the finding carries¶
A location in the document the team edits, a fingerprint that survives unrelated edits, a reproduction (a transcript replayed against NeMo Guardrails for a policy, a dialogue case played through the selector for a router, or the gate's inputs reproduced by agreement), and, where the scan can produce one, a fix whose re-scan it has already run. See the catalogue for the other rules.