Container Registry and Software Supply Chain Platform  ·  View 22 of 33  ·  4 · Runtime

Exceptions and Suppressions

How the platform says yes to something it would otherwise refuse, without creating a permanent hole.

Editable source SVG draw.io All views
Raise scoped request Justify reason + digest Approve approver ≠ requester Encode as Data into the bundle Evaluate same OPA engine Expire mandatory date Re-Raise Finding automatic Exceptions all expire scoped request evidence attached two-person rule bundle data decision logged clock runs out back to the queue Exceptions and Suppressions — Policy, Never Bypass Person or role Application we own Decision point Security / platform A suppression without an expiry is refused at write time. Exception ratio above threshold is an alert. v 1.0 · owner Security Architecture · date 2026-09

Decisions

  • Exceptions are expressed in, and evaluated by, the same OPA engine as ordinary policy — never an enforcement bypass
  • Every grant has a named owner, a justification, an approver who is not the requester, and a mandatory expiry
  • A suppression without an expiry is refused at write time; the finding re-raises automatically on expiry

Making the cost visible

  • The fraction of workloads running under an exception is a metric with a configured alert threshold
  • Suppression is scoped to a named artifact or component, never global
  • Every grant and every use is an audit record

Risk

  • Expiry creates a cliff: a batch of exceptions expiring together can deny a release at the worst moment
  • Mitigation is expiry jitter and a 7-day warning to the owner, not a longer default
◀  Promotion, Demotion and Retention All views Deployment and Infrastructure  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 33 views · open-source, on-premises22-exception-lifecycle