Exceptions and Compensating Controls
When a control cannot be met: what qualifies, what compensates, and the controls that admit no exception.
The gate in Section 17 is absolute by design. Absolute gates fail in one of two ways: teams route around them quietly, or delivery halts and the security function gets overruled from above. A defined exception process prevents both. It is a control in its own right, not an admission that the standard was too ambitious.
18.1 What Qualifies #
An exception is warranted when a control is technically unachievable on the platform in use, when its cost is disproportionate to the assessed risk of that specific agent, or when a dependency outside the organization’s control blocks it. An exception is not warranted because the control is inconvenient, because a deadline is close, or because the team intends to implement it later without committing to a date.
18.2 Requirements #
Every exception records the control ID, the specific reason it cannot be met, the compensating control in place, an expiry date, the residual risk stated in business terms, and a named signatory at the authority level the agent’s tier requires.
| Autonomy tier | Maximum exception duration | Signatory |
|---|---|---|
| T0–T1 | 12 months | Application owner, with security review |
| T2 | 6 months | Security architecture review board |
| T3 | 90 days | CISO or delegated executive |
| T4 | 30 days | CISO and business executive, jointly |
Four rules make the process a control rather than a formality:
- No exception is open-ended. An expired exception is a gate failure. The agent is halted or its tier reduced until the exception is renewed or the control is met.
- Renewal requires re-justification, not extension. A second renewal of the same exception escalates to the next authority level.
- Exceptions are counted and reported. A rising count against a single control means either the control is wrong, the platform is wrong, or the bar is misplaced. All three are findings worth having.
- Compensating controls are verified, not asserted. An exception whose compensating control has never been tested is an undocumented gap wearing a document.
18.3 Compensating Controls #
A compensating control must reduce the same risk as the control it replaces, not a different one that happens to be easier. The distinction is where most exception processes quietly fail.
| Control unavailable | Qualifies as compensating | Does not qualify |
|---|---|---|
| CRED-1— ephemeral credentials | Narrower scope, shorter rotation, and egress restriction bounding where a stolen credential can be used | Increased logging alone |
| TOOL-1— policy engine | Human approval for every side-effecting action, with request volume capped low enough for approval to stay meaningful | A prompt instructing the agent to seek approval |
| ISO-1— default-deny egress | Destination allowlist at a proxy, plus egress volume alerting with a committed response time | Periodic firewall log review |
| OBS-4— automated halt | Staffed monitoring across the agent’s operating hours with a tested manual halt inside the target time-to-effect | An alert routed to an unmonitored queue |
| DATA-4— session isolation | Single-tenant deployment, one principal per instance | Vendor assurance that the model does not retain context |
| SUP-2— MCP authentication | Network-level restriction to a single vetted server, sandboxed, with tool descriptions diffed on every change | Trusting the server because it was approved once |
18.4 Non-Exceptible Controls #
A small number of controls admit no exception, because their absence removes the ability to detect, contain, or account for anything else. An agent that cannot meet these does not run, at any tier.
- DISC-1 — registration with a named human owner. An unowned agent cannot be governed, halted, or retired.
- CRED-5 — tested revocation. Without it, containment is theoretical.
- OBS-1 — action telemetry to central collection. Without it, no other control can be verified and no incident can be reconstructed.
- RESP-1 — an analysis capability reachable without an external approval step.
- GOV-3 — isolation at or above production for any environment running with safety classifiers reduced.