QG305 Write read as a read

Type	Vulnerability
Severity	Critical
Front end	a synthesised host and its router
Guardrail category (Vassilev 2026)	E. Action & Execution Guardrails
AI RMF functions (NIST AI 100-1)	GOVERN, MANAGE
OWASP	LLM03:2026 Excessive Agency, ASI02:2026 Tool Misuse and Exploitation
Gates by default	yes: a new finding under it fails the default quality gate

Raised when

The reader's own write test classes a tool as reading while the model classes it as a write under the host's consent predicate.

Why it matters

Every rule that asks the reader whether a tool writes answers wrongly for this tool. The first is the slip confirmation: a misspelling reaches the tool and nobody is asked.

How to fix it

Correct the model annotation that makes the tool a write, or add the vocabulary sense row that classes its verb; qls-extract vocabulary --derive drafts it from the model's read-only declarations.

OWASP LLM03:2026, "Minimize tools": limit the tools this agent can reach to the ones its task needs.

What the finding carries

A location in the document the team edits, a fingerprint that survives unrelated edits, a reproduction (a transcript replayed against NeMo Guardrails for a policy, a dialogue case played through the selector for a router, or the gate's inputs reproduced by agreement), and, where the scan can produce one, a fix whose re-scan it has already run. See the catalogue for the other rules.