QG008 Call without execute

Type	Vulnerability
Severity	High
Front end	a Colang policy
Guardrail category (Vassilev 2026)	E. Action & Execution Guardrails
AI RMF functions (NIST AI 100-1)	MAP, MANAGE
Why these functions	the catalogue's assignment, not the article's chain (GOVERN, MANAGE): the call never happens, so there is nothing to govern: the finding maps a functional gap and the fix manages it
OWASP	none: the call never happens; a functional defect, not a security risk
Gates by default	no, unless the project's quality profile adds it

Raised when

An assignment calls by name an action the policy elsewhere runs with execute.

Why it matters

Without execute the line is an expression the runtime evaluates, not an action it runs: the call never happens, and the flow goes on as if it had.

How to fix it

Write the call as $result = execute name(...), and re-scan.

What the finding carries

A location in the document the team edits, a fingerprint that survives unrelated edits, a reproduction (a transcript replayed against NeMo Guardrails for a policy, a dialogue case played through the selector for a router, or the gate's inputs reproduced by agreement), and, where the scan can produce one, a fix whose re-scan it has already run. See the catalogue for the other rules.