Pre-approve a few narrow, low impact categories with written limits and short expiry, and review everything else case by case. This clears the queue of routine items so reviewers can spend time where judgement matters, but only if the categories are tight and audited.
Definitions
A pre-approved category is a class of exception that a policy approves in advance if the requester meets stated conditions, so no individual approver is needed. Case-by-case review means a person decides each request on its facts.
Comparison
| Aspect | Pre-approved | Case-by-case |
|---|---|---|
| Speed | Immediate | Slower |
| Reviewer load | Low | High |
| Precision | Rule based | Fact based |
| Risk | Categories drift wide | Inconsistent decisions |
| Fits | Narrow, repeatable, low impact | Novel, high severity |
Good candidates for pre-approval
- Findings in dependencies used only in test or build steps with no network or secrets
- Documentation or example code not shipped to users
- Findings confirmed not reachable by a defined analysis method, at low severity
- Fixed versions that are available but need a scheduled maintenance window, for a very short term
Poor candidates
- Anything on a known exploited list
- Internet facing production services
- Authentication, payment or personal data paths
- Anything with no fix and no compensating control
Conditions every category needs
- Written scope. What exactly qualifies, in terms a tool can check.
- Maximum term. Short, and non-renewable without a person.
- Auto-checks. The tool verifies the conditions at request time, not the requester.
- Auto-revoke triggers. For example, severity increase or exploitation evidence ends it. See what should automatically revoke a vulnerability exception.
- Sampling. A reviewer checks a sample of pre-approved items each week.
- Owner. Someone owns the category definition and reviews it on a schedule.
Guarding against drift
Categories creep. "Test dependencies" quietly starts to include a staging service. Review the category's volume and members every quarter. If a category suddenly doubles, find out why. Also check the share of all exceptions it represents. If most exceptions are pre-approved, either the policy is too loose or the real problem is a backlog that should be fixed.
Audit view
Auditors accept pre-approval when the policy is written, the conditions are enforced and there is evidence of oversight. Keep the approval of the category itself, signed by the right authority, as the record that covers the individual items. Records of each use still need an ID, asset, date and expiry.
Pair with a fix route
A pre-approval is a shortcut for the waiting, not a replacement for fixing. Attach the fix PR or upgrade task to each use.
Safeguard's policies, gates and guardrails can express class-level rules, and its reachability analysis can supply the condition check for "not reachable" categories.
Try it yourself
Click through it at your own pace, or open it full screen.
See how a gate applies rules to a change, then picture which classes you would let through by policy.
Quick check
Are pre-approved categories still exceptions?
Yes. Each use needs a record with scope and expiry, even though no person approves it individually.
How many categories is too many?
Keep the list short enough that reviewers can recite it. Each one needs an owner and a review date.
Last reviewed: 19 October 2026.
