While QI isn't codified in the way you're talking about, Congress and the states do have laws on the books to expose themselves to liability. That's where QI comes from - as an extension of statutory authority to hold the government legally liable. When and how the government and its agents are exposed to liability is very clearly spelled out.