Right now when running the extensible sdk, if an item is not found in locked signatures it will run the task and build it. This behavior is fine for items that have been specifically unlocked. Currently there is an error/warning you can turn on for a task not being in sstate. However, this runs for all tasks in the task graph, not just the ones that will actually run. So ideally we would expand that to instead only error if the tasks to be ran don't exist in sstate.
At least part of this may be covered under bug 9367.
This bug is obsolete since BB_SETSCENE_ENFORCE in conjunction with locked signatures should address the issue.