docs/reference/validation_pipeline.md

@@ -145,7 +145,8 @@ results without re-running the pipeline.
 | `informational_passed`  | `int`                   | Informational passes     |
 | `informational_failed`  | `int`                   | Informational failures   |
 | `results`               | `list[ValidationResult]`| All results              |
-| `all_required_passed`   | `bool` (property)       | True if no req. failures |
+| `all_required_passed`   | `bool` (property)       | `False` if any required failures **or** if no validations ran (empty-run guard, v3.2.0) |
+| `is_empty`              | `bool` (property)       | `True` when result set is empty (zero validations executed) |
 
 ---
 
@@ -218,12 +219,38 @@ Aggregated results with gating decision.
 
 **Properties:** `total`, `required_passed`, `required_failed`,
 `informational_passed`, `informational_failed`, `all_required_passed`,
-`is_empty`
+`is_empty`, `required_total`
 
 **Methods:**
 - `to_plan_metadata()` — Dict for plan `validation_summary` field
 - `format_cli_output()` — Human-readable summary for CLI display
 
+#### Empty-Run Guard (v3.2.0, PR #7786)
+
+!!! warning "Breaking behaviour change"
+    Prior to v3.2.0, `all_required_passed` returned `True` when zero
+    validations were run, silently bypassing the apply gate.
+
+`all_required_passed` now returns `False` when `is_empty` is `True`
+(i.e. the result set is empty — no validations were executed at all).
+This ensures that apply is **blocked** unless at least one validation
+was actually run.
+
+| Condition | `is_empty` | `all_required_passed` | Apply |
+|-----------|-----------|----------------------|-------|
+| No validations run | `True` | `False` | **Blocked** |
+| All required pass | `False` | `True` | Allowed |
+| Any required fails | `False` | `False` | **Blocked** |
+
+The `required_total` property (`required_passed + required_failed`) is
+also available for display and diagnostic purposes.
+
+**Why this matters:** Plans with no attached validations (e.g. plans
+created before validations were configured, or plans on resources with
+no validation rules) previously proceeded to apply without any gate
+check.  The empty-run guard ensures that the gate is always meaningful —
+if no validations ran, the plan must be explicitly reviewed before apply.
+
 ## Runner Interface
 
 ### `ValidationRunner` (ABC)