QG006 Unverified region¶
| Type | Bug |
| Severity | High where the region's flow registers a scanned action, Low otherwise |
| Front end | a Colang policy, or its IR record |
| Guardrail category (Vassilev 2026) | F. Monitoring, Auditing & Logging Guardrails |
| AI RMF functions (NIST AI 100-1) | MEASURE, MANAGE |
| OWASP | none: a statement about the scope of the scan, not a risk in the policy |
| Gates by default | no, unless the project's quality profile adds it |
Raised when¶
Lines the compiler did not understand, attributed to their enclosing flow.
Why it matters¶
A line the compiler skipped is a guard the circuit does not have, and a missing guard reads as a bypass or hides one. Nothing inside the region is verified, and an obligation whose flow holds one is not decided.
How to fix it¶
Rewrite the lines in the subset the compiler reads, or move them out of the flows that register actions.
What the finding carries¶
A location in the document the team edits, a fingerprint that survives unrelated edits, a reproduction (a transcript replayed against NeMo Guardrails for a policy, a dialogue case played through the selector for a router, or the gate's inputs reproduced by agreement), and, where the scan can produce one, a fix whose re-scan it has already run. See the catalogue for the other rules.