Handle exceptions with a short written request, a named approver, compensating controls and an expiry date, then keep a register that someone reviews. Exceptions are not a failure of the policy. Unrecorded exceptions are, because they become the real policy without anyone deciding.
Why you need a process
Developers will ask to use a new model, tool or agent feature faster than any policy update cycle. If the answer is a slow no, they use it anyway. A fast, documented yes-with-conditions keeps you informed and in control.
The request template
| Field | Content |
|---|---|
| Requester and owner | Who asks and who is accountable |
| Tool and version | Exactly what is requested |
| Purpose | The task and why approved tools fall short |
| Data involved | Which data class, using your classification |
| Repositories | Scope, ideally named |
| Compensating controls | Sandbox, review, no secrets, logging |
| Duration | Start and end dates |
Keep it to one page. If filling the form takes an hour, people skip it.
Approval rules
- Low risk, public data only: team lead can approve.
- Internal code: security approves.
- Restricted data or unattended agents: security and the data owner approve.
- Anything touching regulated data: legal and compliance are also involved.
Set a response target and publish it. A few working days is realistic for the middle tiers.
Compensating controls that make a yes safe
- Run the tool in a sandbox or a separate environment.
- Limit it to one repository or a test fork.
- Turn off or deny file access to secrets.
- Require review by a code owner for every change.
- Log usage during the trial.
Review and expiry
Every exception expires, ideally within 90 days. At expiry the choices are: end it, add the tool to the approved list, or renew with a reason. Review the register monthly to spot patterns. Three requests for the same tool is a signal to evaluate it properly.
What auditors want to see
A register with dates, approvers and expiry, evidence that expired items were closed, and a few examples of compensating controls in effect. That is a small amount of paperwork for strong evidence of control.
Quick check
Can the requester approve their own exception?
No. Separate the requester from the approver, even in a small team.
What if an exception expires and nobody notices?
Make expiry automatic: set calendar reminders or tickets at creation, and review the register monthly.
Safeguard offers compliance and evidence automation that helps keep records like an exception register organized, plus a free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
