QG004 Permissive by default¶
| Type | Bug |
| Severity | Medium |
| Front end | a Colang policy, or its IR record |
| Guardrail category (Vassilev 2026) | B. Policy & Governance Guardrails |
| AI RMF functions (NIST AI 100-1) | GOVERN, MAP, MANAGE |
| OWASP | LLM03:2026 Excessive Agency, ASI02:2026 Tool Misuse and Exploitation |
| Gates by default | no, unless the project's quality profile adds it |
Raised when¶
A flow refuses on listed conditions and leaves the action reachable otherwise.
Why it matters¶
Any context matching none of the refusals reaches the action. That is the opposite of unknown-means-blocked, and no reachability question shows it, because the rules behave exactly as written.
How to fix it¶
Terminate the flow with a refusal, so the default is deny and the listed conditions are the exceptions.
OWASP LLM03:2026, "Require user approval": where the call writes, require the user's approval before this action runs, alongside a control on the call.
What the finding carries¶
A location in the document the team edits, a fingerprint that survives unrelated edits, a reproduction (a transcript replayed against NeMo Guardrails for a policy, a dialogue case played through the selector for a router, or the gate's inputs reproduced by agreement), and, where the scan can produce one, a fix whose re-scan it has already run. See the catalogue for the other rules.