QG010 Dead action¶
| Type | Vulnerability |
| Severity | High |
| Front end | a Colang policy |
| Guardrail category (Vassilev 2026) | B. Policy & Governance Guardrails |
| AI RMF functions (NIST AI 100-1) | MEASURE, MANAGE |
| Why these functions | the catalogue's assignment, not the article's chain (GOVERN, MAP, MANAGE): whether the action can run at all is measured by a reachability question and managed by the fix; no governance rule is in question |
| OWASP | LLM03:2026 Excessive Agency |
| Gates by default | no, unless the project's quality profile adds it |
Raised when¶
An action no state of the policy performs.
Why it matters¶
Every obligation on the action holds because the action never runs: a refusal that never fires, or a call that never happens. A policy that blocks everything passes every check of what it must not let through.
How to fix it¶
Find the guard that can never hold, usually an inverted or contradictory test, and re-scan.
What the finding carries¶
A location in the document the team edits, a fingerprint that survives unrelated edits, a reproduction (a transcript replayed against NeMo Guardrails for a policy, a dialogue case played through the selector for a router, or the gate's inputs reproduced by agreement), and, where the scan can produce one, a fix whose re-scan it has already run. See the catalogue for the other rules.