QG009 Undefined bot message¶
| Type | Vulnerability |
| Severity | Medium |
| Front end | a Colang policy |
| Guardrail category (Vassilev 2026) | B. Policy & Governance Guardrails |
| AI RMF functions (NIST AI 100-1) | MAP, MANAGE |
| Why these functions | the catalogue's assignment, not the article's chain (GOVERN, MAP, MANAGE): which replies the author fixed and which the model writes is a map of the policy, and the fix manages the gap; no governance rule is in question |
| OWASP | LLM07:2026 Misinformation, ASI09:2026 Human-Agent Trust Exploitation |
| Gates by default | no, unless the project's quality profile adds it |
Raised when¶
A bot message with no definition, one character from a message the policy defines.
Why it matters¶
A bot message the policy does not define is written by the model at run time. The reply the author fixed is replaced by generated text, which no rail has checked.
How to fix it¶
Use the defined message's name, or define the message, and re-scan.
What the finding carries¶
A location in the document the team edits, a fingerprint that survives unrelated edits, a reproduction (a transcript replayed against NeMo Guardrails for a policy, a dialogue case played through the selector for a router, or the gate's inputs reproduced by agreement), and, where the scan can produce one, a fix whose re-scan it has already run. See the catalogue for the other rules.