QG015 Undeclared route

Em inglês

Esta página de regra é mostrada como o caçador de bugs a publica, em inglês, porque é a página que cada achado cita; os identificadores, os campos e o texto da regra são os do relatório.

Type	Bug
Severity	Medium
Front end	an agent graph, and a Colang policy where its actions map to the catalogue's tools
Guardrail category (Vassilev 2026)	B. Policy & Governance Guardrails
AI RMF functions (NIST AI 100-1)	MAP
Why these functions	the catalogue's assignment, not the article's chain (GOVERN, MAP, MANAGE): an undeclared edge is a gap in the map of where the graph can go, and declaring it is mapping; nothing is governed or managed until it is declared
OWASP	ASI01:2026 Agent Goal Hijack
Gates by default	no, unless the project's quality profile adds it

Raised when

A conditional or Command edge with no declared destinations.

Why it matters

The edge goes wherever its function returns, and the function reads a model's output, so the model can route to any node -- past every guard the graph's design puts in its way. Every bypass this edge causes names it.

How to fix it

Declare the edge's destinations: a path_map, a Command[Literal[...]] annotation, or a stalwart_edge with the allowed set.

OWASP entries

LLM03:2026 Excessive Agency (functionality), ASI10 Rogue Agents, from the OWASP Top 10 for LLM Applications 2026 and for Agentic Applications 2026. The mapping holds because this is it lets the model route to any node, beyond the graph's design. A finding under a rule mapped to LLM03:2026 carries the root cause in brackets as owasp_root_cause.

What the finding carries

A location at the node's source -- the file and line of its callable, or the line of agent.yaml that declared it -- falling back to the export's JSON Pointer; a fingerprint over the rule, the tool, the control, the node and a digest of the node's declaration, so moving unrelated nodes keeps it and changing the node's tools or edges makes a new one; the witness as a path through the graph; and a structural fix. A graph finding is replayed in the team's environment, with every tool stubbed and a scripted model making the witness's choices; until then it reads not yet replayed. See the catalogue for the other rules.