{"ruleset":{"id":"queldrex:baseline","version":"2026.07.2"},"count":20,"laws":[{"id":"QX-L-0001","key":"canary.tripwire","title":"Invocation of a decoy tool","text":"An agent must not invoke a Queldrex canary tool. Canaries are decoys that no legitimate workflow has any reason to call.","rationale":"A canary call is not a probability, it is evidence. Nothing legitimate discovers and invokes a decoy, so this is treated as a confirmed compromise rather than a risk score. It is denied before every other check precisely because it needs no interpretation.","severity":"prohibition","effect":"deny","branch":"executive","inForceSince":"2026.07.1","status":"active","appealable":false,"mappings":[{"framework":"OWASP-ASI","id":"ASI10","note":"Rogue Agents"}]},{"id":"QX-L-0002","key":"tool.failed_verification","title":"Tool failed safety verification","text":"A tool whose definition scores at or above the failure threshold must not be invoked.","rationale":"An agent reads a tool description before it ever calls the tool, so a poisoned description has already influenced the model by the time execution would begin. Verification has to bind before the call, not after.","severity":"prohibition","effect":"deny","branch":"executive","inForceSince":"2026.07.1","status":"active","appealable":true,"mappings":[{"framework":"OWASP-MCP","id":"MCP03","note":"Tool Poisoning"},{"framework":"OWASP-ASI","id":"ASI02","note":"Tool Misuse and Exploitation"}]},{"id":"QX-L-0003","key":"tool.unresolved_risk","title":"Unresolved risk requires a human","text":"A tool carrying unresolved risk signals below the failure threshold requires human approval before invocation.","rationale":"Uncertainty is not safety. Where the evidence is genuinely ambiguous the correct actor is a person, not a threshold. Defaulting ambiguity to allow would make every borderline case a silent yes.","severity":"approval","effect":"require_approval","branch":"executive","inForceSince":"2026.07.1","status":"active","appealable":true},{"id":"QX-L-0004","key":"call_args.malicious","title":"Malicious call argument","text":"A tool call whose arguments contain an unambiguous attack signature must be denied, regardless of whether the tool itself is legitimate.","rationale":"The common real attack is a clean tool driven with a hostile value: a cloud metadata address, a credential file path, a shell injection. Verifying only the tool definition misses this entirely, because the definition is honest and the argument is not.","severity":"prohibition","effect":"deny","branch":"executive","inForceSince":"2026.07.1","status":"active","appealable":true,"mappings":[{"framework":"OWASP-ASI","id":"ASI05","note":"Unexpected Code Execution"}]},{"id":"QX-L-0005","key":"call_args.suspicious","title":"Suspicious call argument","text":"A tool call whose arguments carry risk signals short of an unambiguous attack requires human approval.","rationale":"Several argument patterns have real legitimate uses. Loading your own model with remote code enabled is ordinary work; loading someone else's that way is not, and the difference is context we do not have. A person does.","severity":"approval","effect":"require_approval","branch":"executive","inForceSince":"2026.07.1","amendedIn":"2026.07.2","status":"active","appealable":true,"mappings":[{"framework":"OWASP-ASI","id":"ASI04","note":"Agentic Supply Chain"}]},{"id":"QX-L-0006","key":"rule_of_two.lethal_trifecta","title":"Untrusted input, sensitive data, and egress in one session","text":"A session that has ingested untrusted input, accessed sensitive data, and can send data outward requires human approval before the egress step.","rationale":"Each capability alone is ordinary. Together in one session they are the complete shape of an exfiltration, and by the time the third is exercised the first two have already happened. The judgment must be made on what the session actually did, not on what the caller says it did.","severity":"approval","effect":"require_approval","branch":"executive","inForceSince":"2026.07.1","status":"active","appealable":true,"mappings":[{"framework":"OWASP-ASI","id":"ASI06","note":"Memory and Context Poisoning"}]},{"id":"QX-L-0007","key":"rug_pull.drift","title":"Tool changed after approval","text":"A tool whose content hash differs from the version previously approved for this account requires re-review.","rationale":"Approval attaches to a specific version, not to a name. A tool that passes review and then changes has not been reviewed. Pinning at call time catches this when it matters rather than at the next scheduled scan.","severity":"approval","effect":"require_approval","branch":"executive","inForceSince":"2026.07.1","status":"active","appealable":true,"mappings":[{"framework":"OWASP-ASI","id":"ASI04","note":"Agentic Supply Chain"}]},{"id":"QX-L-0008","key":"behavior.velocity_anomaly","title":"Abnormal call rate within a session","text":"A session exceeding the declared call-rate ceiling requires human approval to continue.","rationale":"A runaway loop and a compromised agent look the same from outside, and both are worth pausing. This is deliberately a floor for noisy failure, not a defence against distributed activity: an attacker who shards work across sessions stays under any per-session rate.","severity":"approval","effect":"require_approval","branch":"executive","inForceSince":"2026.07.1","status":"active","appealable":true},{"id":"QX-L-0009","key":"killswitch.active","title":"Account stopped","text":"While an account is stopped, by a person or by the circuit breaker, all governed calls are denied.","rationale":"A stop that can be overridden by ordinary traffic is not a stop. This overrides every other rule including monitor mode, because the entire purpose of a kill switch is that it is unconditional.","severity":"prohibition","effect":"deny","branch":"executive","inForceSince":"2026.07.1","status":"active","appealable":true},{"id":"QX-L-0010","key":"policy.pass","title":"Customer policy","text":"An account's own policy may tighten any decision. It may never loosen one.","rationale":"Customers know their environment and should be able to be stricter than the baseline. Allowing them to be looser would let a compromised console disable the protection, so the direction is one-way by construction.","severity":"advisory","effect":"record","branch":"executive","inForceSince":"2026.07.1","status":"active","appealable":true},{"id":"QX-L-0011","key":"feedback.owner_blocked","title":"Human labelled this version malicious","text":"A tool version a human on this account has confirmed malicious is denied on sight.","rationale":"A human judgment on a specific version outranks any automated score. Re-litigating a decided case wastes the reviewer and risks reversing them silently.","severity":"prohibition","effect":"deny","branch":"judicial","inForceSince":"2026.07.1","status":"active","appealable":true},{"id":"QX-L-0012","key":"feedback.owner_allowed","title":"Human cleared this version","text":"A tool version a human on this account has confirmed benign clears a soft approval for that exact version.","rationale":"The counterpart to the law above, and the reason both exist: a review process that can only ever convict is not a review process. Clearance binds to the exact version, so a later change re-opens the question.","severity":"advisory","effect":"allow","branch":"judicial","inForceSince":"2026.07.1","status":"active","appealable":true},{"id":"QX-L-0013","key":"monitor.shadowed","title":"Monitor mode","text":"While an account is in monitor mode, decisions are recorded with what would have been enforced, and nothing is blocked.","rationale":"Adoption fails if the first day of enforcement breaks production. Monitor mode lets an account see the judgments before they bind. The shadow decision is recorded so the record never claims a block that did not occur.","severity":"advisory","effect":"record","branch":"executive","inForceSince":"2026.07.1","status":"active","appealable":false},{"id":"QX-L-0014","key":"observation.actor_churn","title":"New principal reaching for capability","text":"A principal first seen minutes ago, appearing alongside existing principals on the account and immediately using sensitive or outbound tools, is recorded for review.","rationale":"Credential rotation is the standard evasion against any identity-scoped memory, so instrumenting the churn turns the evasion into the signal. It records and never blocks, because ordinary fan-out workloads produce the same shape and enforcing here would fail across a customer's whole fleet at once.","severity":"advisory","effect":"record","branch":"executive","inForceSince":"2026.07.2","status":"active","appealable":false,"mappings":[{"framework":"OWASP-ASI","id":"ASI03","note":"Agent Identity and Privilege Abuse"}]},{"id":"QX-L-0015","key":"observation.retro_hunt","title":"Correlated activity across sessions","text":"Activity joined across a principal's sessions that persists across days, or that includes an already-blocked call, is surfaced for review.","rationale":"Enforcement holds one hour of state so it stays cheap. Campaigns outlast an hour. The long look happens offline over durable records and produces an investigation surface, never a verdict.","severity":"advisory","effect":"record","branch":"executive","inForceSince":"2026.07.2","status":"active","appealable":false},{"id":"QX-L-0016","key":"continuity.server_face_changed","title":"Server changed what it declares itself to be","text":"A server presenting a self-description that differs from the one previously recorded for that endpoint is reported, with the specific difference named.","rationale":"MCP 2026-07-28 removes the initialize handshake, removes sessions, and states that a server's self-reported identity is unverified and must not drive security decisions. No client-side anchor remains for noticing that a server changed. Statelessness constrains servers, not an observer in the path, so we keep the memory the protocol discards. Reported and never blocked, because the ordinary cause is that somebody deployed.","severity":"advisory","effect":"record","branch":"executive","inForceSince":"2026.07.2","status":"active","appealable":false,"mappings":[{"framework":"OWASP-ASI","id":"ASI04","note":"Agentic Supply Chain"}]},{"id":"QX-L-0017","key":"toxic_flow.tainted_egress","title":"A named path from untrusted input to an egress tool","text":"Where the specific untrusted origin and the specific sensitive source that can reach an egress tool are both known, the finding names them, and the call requires human approval.","rationale":"This is QX-L-0006 with the evidence attached. The same three capabilities are present, but the path has been observed rather than inferred, so the record can state which tool introduced the untrusted input and which read the sensitive data. Naming the path is what lets a reviewer confirm or refute the finding in seconds instead of reconstructing a session by hand, and a finding a human can check quickly is one they will actually check.","severity":"approval","effect":"require_approval","branch":"executive","inForceSince":"2026.07.1","status":"active","appealable":true,"mappings":[{"framework":"OWASP-ASI","id":"ASI06","note":"Memory and Context Poisoning"}]},{"id":"QX-L-0018","key":"enforce.unavailable","title":"Queldrex could not be reached","text":"When the enforcement service is unreachable or times out, the in-process SDK applies the fail mode the customer configured, and records that the decision was made without us.","rationale":"A governed call that cannot reach its governor still has to resolve one way or the other. Recording this as an ordinary allow or deny would put a claim in the record that we judged something we never saw. It is published as a law because the customer chooses the fail mode, and they are entitled to know that the choice is part of the ruleset rather than an implementation detail.","severity":"advisory","effect":"record","branch":"executive","inForceSince":"2026.07.2","status":"active","appealable":true},{"id":"QX-L-0019","key":"policy.customer_rule","title":"A rule the account wrote for itself","text":"An account may write rules that tighten any decision for its own traffic. The specific rule that matched is identified by the account's own rule id.","rationale":"Customer rules are law over that account's traffic and belong in the corpus, but their text belongs to the customer, not to us. We publish that the category exists and that it is tighten-only; we do not publish another account's rules. Note the asymmetry this creates and accept it: an account can always explain its own decision, because it wrote the rule.","severity":"advisory","effect":"record","branch":"legislative","inForceSince":"2026.07.1","status":"active","appealable":true},{"id":"QX-L-0020","key":"killswitch.indeterminate","title":"Account stop state could not be determined","text":"When the kill-switch state cannot be read, an otherwise-allowed action requires human approval rather than proceeding.","rationale":"A stop that fails open under a storage outage is not a stop, and one that fails closed turns a storage hiccup into a total outage. So an unreadable stop is treated as neither: it is indeterminate, and uncertainty about whether an account is stopped is resolved by a person, not by a silent allow. This is the availability layer applying the same rule as any other unresolved risk: when a required check cannot answer, the correct actor is a human.","severity":"approval","effect":"require_approval","branch":"executive","inForceSince":"2026.07.2","status":"active","appealable":true}],"notice":"Framework references are alignment, not compliance. There is no compliance regime for these frameworks and claiming one would be false."}