Governance Exception Register
Purpose: Record all approved deviations from the security and engineering baseline defined in
governance.md. Each exception must be time-bounded, risk-accepted by a named decision-maker, and linked to a remediation ticket.Review cadence: Quarterly. Expired exceptions without renewal are automatically escalated to Platform Engineering lead.
Active Exceptions
| ID | Control Deviated From | Justification | Risk Level | Expires | Owner | Ticket |
|---|---|---|---|---|---|---|
| EX-001 | SQLite in unit test conftest bypasses Alembic migration path | Enables zero-infra unit tests; SQLite schema is created from ORM metadata. Integration tests use full Alembic + Postgres path. See ADR-003. | Low | 2027-05-23 (annual renewal) | Platform Engineering | — |
| EX-002 | Redis fail-open policy on denylist check under outage | Fail-closed (blocking all auth) during Redis outage is operationally unacceptable for an incident response tool. Fail-open is documented in ADR-002 as an explicit risk. | Medium | 2027-01-01 | Security | INFRA-TBD |
Closed / Resolved Exceptions
| ID | Control | Resolved Date | Resolution |
|---|---|---|---|
| — | — | — | — |
Exception Request Process
- Engineer raises exception request using
templates/governance-exception-request.md. - Security reviews within 5 business days.
- Platform Engineering lead approves or rejects.
- Approved exception is added to this register with an expiry date ≤ 12 months.
- Ticket created in issue tracker for remediation tracking.
- Register reviewed quarterly; expired exceptions trigger escalation.
Risk Level Definitions
| Level | Criteria |
|---|---|
| Low | No direct data exposure; compensating controls in place; limited blast radius |
| Medium | Potential indirect exposure; time-bounded; monitored via alerts |
| High | Direct security control deviation; requires CISO sign-off; max 90-day duration |
| Critical | Not permissible via exception register; requires architectural remediation |