QG305 Write read as a read¶
Em inglês
Esta página de regra é mostrada como o caçador de bugs a publica, em inglês, porque é a página que cada achado cita; os identificadores, os campos e o texto da regra são os do relatório.
| Type | Vulnerability |
| Severity | Critical |
| Front end | a synthesised host and its router |
| Guardrail category (Vassilev 2026) | E. Action & Execution Guardrails |
| AI RMF functions (NIST AI 100-1) | GOVERN, MANAGE |
| OWASP | LLM03:2026 Excessive Agency, ASI02:2026 Tool Misuse and Exploitation |
| Gates by default | yes: a new finding under it fails the default quality gate |
Raised when¶
The reader's own write test classes a tool as reading while the model classes it as a write under the host's consent predicate.
Why it matters¶
Every rule that asks the reader whether a tool writes answers wrongly for this tool. The first is the slip confirmation: a misspelling reaches the tool and nobody is asked.
How to fix it¶
Correct the model annotation that makes the tool a write, or add the vocabulary sense row that classes its verb; qls-extract vocabulary --derive drafts it from the model's read-only declarations.
OWASP LLM03:2026, "Minimize tools": limit the tools this agent can reach to the ones its task needs.
What the finding carries¶
A location in the document the team edits, a fingerprint that survives unrelated edits, a reproduction (a transcript replayed against NeMo Guardrails for a policy, a dialogue case played through the selector for a router, or the gate's inputs reproduced by agreement), and, where the scan can produce one, a fix whose re-scan it has already run. See the catalogue for the other rules.