Documentation
Exception details
Review one exception's business case and history, and approve, reject, withdraw or revoke it.
Overview
The exception page shows one risk-acceptance exception: the business case, the evidence, the decision trail and the vulnerability match it covers. Approvers decide here; requesters follow their request and can withdraw it. Open it by clicking Open on Exceptions, or View exception → on a CVE’s Exceptions tab.
Screen tour
- The expiry bar, the exception number (for example Exception #2d610157) and its status.
- The chips: the linked match, the reason and the age of the request.
- The decision cluster: Approve for approvers, Withdraw for the requester. Shown while the exception is pending.
- The justification: reason, business case, evidence and compensating controls.
- Decision trail: who requested and who decided, and what happened to the match.
- Linked match: the vulnerability match that the exception covers.
- The pin strip: Status, expiry, approval chain, linked records and reason.
Decision cluster
While the exception is requested, the area under the header shows the decision you can take:
- Approve, if you have
exceptions:approveand are not the requester. Approving makes the exception active and marks the linked match Accepted risk. - Withdraw, if you are the requester. Withdrawing closes your request.
To reject, use the Status menu in the pin strip (see below).
Once an exception is rejected, withdrawn, revoked or expired, the page shows This exception is closed. Submit a fresh request if the risk has re-emerged.
Justification
The justification shows what the requester entered:
- Reason: one of the six reasons.
- Business case: the explanation. CVE IDs are highlighted and URLs are links.
- Evidence: the supporting links.
- Compensating controls: the controls that reduce the risk, as chips.
- Review cadence, for permanent exceptions.
Decision trail
The Decision trail lists the exception’s history:
- Requested: who requested it, when, and the suggested approver (or No suggested approver assigned.). While pending, the trail shows Awaiting decision.
- The decision, once taken: Approved, Rejected, Withdrawn, Revoked or Expired, with who decided, when (hover for the exact time), the reason if one was given, and what happened:
- Approved: Exception became active. Linked match moved to accepted_risk.
- Rejected: Request closed.
- Withdrawn: Request closed by author.
- Revoked or Expired: Linked match restored to …, with the status the match returned to. If someone changed the match during the exception, the trail says it was not restored and shows its current status.
Expiry is recorded as system (lazy expiry).
Linked match
Linked match shows the match ID and, once approved, Match status before exception: the status the match will return to when the exception ends. Approval moves the linked match to Accepted risk; revoke or expiry restores its prior status.
Click the Match chip in the header to list all exceptions for the same match.
Pin strip
| Item | What it shows |
|---|---|
| Status | The current status. Click it to open Status actions. |
| Expiry | The expiry bar and the time left, or ∞ permanent. |
| Approval chain | The steps so far, for example Requested → Approved → Revoked. |
| Linked records | Match, Requester, Suggested approver (when set) and Decided by. |
| Reason | The reason category. |
← All exceptions returns to the list.
Status actions
Click the Status chip to see the actions for the current status:
- Status chip: click it to open Status actions.
- Reject…: rejects the request, with an optional reason.
- Withdraw: shown to the requester. As the requester, you see Withdraw in place of Approve, so another approver decides on your request.
| Status | Actions |
|---|---|
| Requested | Approve (approvers other than the requester), Reject… (approvers), Withdraw (the requester) |
| Approved | Revoke… (approvers) |
| Rejected, Withdrawn, Revoked, Expired | Terminal state — no further actions. |
Reject… and Revoke… ask for an optional reason (Reject reason (optional), Revoke reason (optional)), for example why the risk is not acceptable or why the acceptance no longer holds. Click Confirm reject or Confirm revoke.