QG301 Router bypass

Type	Vulnerability
Severity	by what the action can do: Critical for a destructive or irreversible write, High for a write, Medium for a read, High when no extracted model classes it
Front end	a synthesised host and its router
Guardrail category (Vassilev 2026)	E. Action & Execution Guardrails
AI RMF functions (NIST AI 100-1)	GOVERN, MANAGE
OWASP	LLM03:2026 Excessive Agency, ASI02:2026 Tool Misuse and Exploitation
Gates by default	yes: a new finding under it fails the default quality gate

Raised when

A tool reached outside the agent's whitelist, a query matching nothing resolved, or a tool run after the router resolved nothing.

Why it matters

The routing obligations are what keep a turn inside what an agent may do. One that fails dispatches a tool the agent was never given, or dispatches on no match.

How to fix it

Change the input that produces the guard the patch adds: the agent whitelist, or the intent library entry.

OWASP LLM03:2026, "Complete mediation": enforce the check in the rail, which decides from trusted state, rather than relying on the model to decide whether the action is allowed.

OWASP LLM03:2026, "Minimize tools": limit the tools this agent can reach to the ones its task needs.

What the finding carries

A location in the document the team edits, a fingerprint that survives unrelated edits, a reproduction (a transcript replayed against NeMo Guardrails for a policy, a dialogue case played through the selector for a router, or the gate's inputs reproduced by agreement), and, where the scan can produce one, a fix whose re-scan it has already run. See the catalogue for the other rules.