QG302 Unsupported argument

Em inglês

Esta página de regra é mostrada como o caçador de bugs a publica, em inglês, porque é a página que cada achado cita; os identificadores, os campos e o texto da regra são os do relatório.

Type	Vulnerability
Severity	by what the action can do: Critical for a destructive or irreversible write, High for a write, Medium for a read, High when no extracted model classes it
Front end	a synthesised host and its router
Guardrail category (Vassilev 2026)	E. Action & Execution Guardrails
AI RMF functions (NIST AI 100-1)	GOVERN, MANAGE
OWASP	ASI02:2026 Tool Misuse and Exploitation
Gates by default	yes: a new finding under it fails the default quality gate

Raised when

A required argument reaches the tool that was neither typed, confirmed, cited nor derived; or is malformed; or lies outside its declared domain.

Why it matters

An argument nobody stated is a value the system made up, and a write run on it does something nobody asked for.

How to fix it

Declare the argument's domain, or require the entity in the intent library entry, so the router asks for it.

What the finding carries

A location in the document the team edits, a fingerprint that survives unrelated edits, a reproduction (a transcript replayed against NeMo Guardrails for a policy, a dialogue case played through the selector for a router, or the gate's inputs reproduced by agreement), and, where the scan can produce one, a fix whose re-scan it has already run. See the catalogue for the other rules.