QG104 Check missing against its peers¶
| Type | Security hotspot |
| Severity | review |
| Front end | a Colang policy |
| Guardrail category (Vassilev 2026) | B. Policy & Governance Guardrails |
| AI RMF functions (NIST AI 100-1) | MAP |
| Why these functions | the catalogue's assignment, not the article's chain (GOVERN, MAP, MANAGE): a hotspot asks a person to map whether the call needs its siblings' control; nothing is governed or managed until they decide |
| OWASP | LLM03:2026 Excessive Agency, ASI02:2026 Tool Misuse and Exploitation |
| Gates by default | no, unless the project's quality profile adds it |
Raised when¶
A tool call whose cone never reaches a control that is necessary for a sibling action, one sharing at least one necessary control with it.
Why it matters¶
Two actions that share a necessary control sit under one control regime, and the policy never consults this control on this call at all. It may be meant; it is how a forgotten lock looks from inside the policy.
How to fix it¶
Decide whether the call needs the control. If it does, add the check and a property table row naming it; if not, accept the hotspot with the reason.
OWASP LLM03:2026, "Complete mediation": enforce the check in the rail, which decides from trusted state, rather than relying on the model to decide whether the action is allowed.
What the finding carries¶
A location in the document the team edits, a fingerprint that survives unrelated edits, a reproduction (a transcript replayed against NeMo Guardrails for a policy, a dialogue case played through the selector for a router, or the gate's inputs reproduced by agreement), and, where the scan can produce one, a fix whose re-scan it has already run. See the catalogue for the other rules.