Architecture exception
Can a standards exception proceed, and under whose authority?
Internal reporting service requests a 90-day secrets-management exception. No PCI data. Compensating HSM control verified by Security. Migration funded, owner named, expiry set. No previous exception.
Choice + probability + evidence-quality score
AUTOMATE only when containment ≥90%, first exception, compensating controls verified and authority delegated. Repeat exceptions or regulated-control uncertainty → ESCALATE.
Record exception, owner, expiry and remediation; otherwise create ARB case.
Bounded, reversible, verified first exception inside delegated policy.