Skip to content
ArchNGN

Exceptions

Exceptions lists every deviation from policy that someone accepted on purpose. Each entry says what was accepted, about which component, who decided, when, why and until when. Deviations agreed in a meeting or a chat leave no record. These do.

Open it from Governance → Exceptions. Anyone who can open the workspace can read it.

What appears here

Section titled “What appears here”
ExceptionWhere it is madeWhat it records
Accepted riskAccept risk… on a finding, on a recorded design check, or through the APIThe rule, the component (or every component the rule flags), the reason, who accepted it, and the expiry.
Rule switched offRules on a pack under Settings → PoliciesThe rule, its pack and version, the reason, and who switched it off. Applies to the whole account.

The list shows Exception, About, Why, Who, Until and Status. It shows exceptions in force by default. Switch on Show expired, revoked and renewed to see the rest. Filters narrows by kind of exception, or by search.

Each entry has a status:

  • Active or In force: it applies now.
  • Expired: an accepted risk that ran its course. Its finding counts again.
  • Revoked: an accepted risk someone ended early.
  • Renewed: an accepted risk replaced by a newer one, which links back to it.

Above the list, accepted risks are shown as debt: how many are in force, how many expire in the next 30 days, their average age and the oldest, and how many cover a whole workspace rather than one component. The older an accepted risk gets, the more it costs to unwind.

Reasons are required

Section titled “Reasons are required”
  • An accepted risk needs a reason and an expiry. In the app the reason is at least 12 characters and the expiry at most a year. Through the API or the archngn waive command, the expiry can be up to two years.
  • Switching a rule off needs a reason. It accepts the risk the rule exists to prevent, so the Rules dialog asks why before it saves.

Switching a pack or rule to Advisory or Enforce needs no reason, and isn’t listed here. Every state change is in the audit log.

Act on an exception

Section titled “Act on an exception”

From an entry’s actions:

  • Renew with a new expiry: a renewal is a new decision, with its own reason and expiry. The old entry is closed and shown as Renewed, and the new one links back to it.
  • Revoke: end an accepted risk now. Its finding counts again. A revoked risk can’t be renewed. Accept it again instead.
  • Switch rule back on: for a rule that was switched off.

Acting on an accepted risk needs the check:waive capability. Switching a rule back on needs policy:manage. Account admins have both.

One component’s exceptions

Section titled “One component’s exceptions”

An object’s details list the exceptions about it, so anyone looking at a component can see the risks accepted for it.

Export

Section titled “Export”

Download CSV and Download Markdown export the entries shown, after filters, ready to hand to an auditor.

Section titled “Related”