---
title: "Request and approve exceptions"
description: "Record a compliance control you have decided not to meet, with a justification and an expiry, and have a second person approve it."
url: "https://support.outpostplatform.com/compliance/exceptions/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "How compliance exceptions work in the Outpost console. Request one from a control's page with a scope, justification, and expiry at most a year out. Someone other than the requester, holding compliance:manage, approves it under Compliance > Exceptions. Approved exceptions show as Excepted, not compliant. Revoke, expiry, views, and the audit trail."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  permission: "compliance:manage"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/compliance/exceptions.md"
license: "CC BY 4.0"
---

# Request and approve exceptions

An exception records that your organization has decided not to meet one
control, why, and until when. Once someone other than the requester approves
it, the endpoints it covers show **Excepted** for that control instead of
**Gap**. Use an exception when a control cannot or should not be met on some
endpoints and you have a compensating measure or an accepted risk to point an
auditor at.

## Before you begin

- Requesting an exception needs only `compliance:read`. Approving and revoking
  need `compliance:manage`, which the Owner and Support Manager roles hold.
- Approval takes two people. The person who requested an exception cannot
  approve it.
- Every exception expires, at most a year after it is requested. When it
  expires, the finding is live again.
- An exception changes what the compliance pages report. It does not change
  what is enforced on the endpoint. A framework floor still applies.
- Exceptions are never deleted. Revoked and expired ones stay in the register
  as part of the record.

## Request an exception

You request an exception from the control it covers, so the framework and the
setting come from the finding.

1. Select **Compliance** > **Overview**, then the framework, then the control.
   See [Review compliance posture](/compliance/compliance-overview/).
2. Select **Request exception**. The **Request an exception** dialog opens
   with the framework and setting filled in. They cannot be changed.
3. In **Scope**, choose what the exception covers:
   - `tenant` covers every endpoint of this client. On Home Lab, Essentials,
     and Enterprise, that is your whole organization.
   - `site`, `device_group`, or `endpoint` covers one site, device group, or
     endpoint. Enter its ID in **Scope id**.
4. In **Justification**, enter why the control is not met and what
   compensates for it. This is what an auditor reads.
5. In **Expires**, choose a date. It can be today, and at most a year from
   today. The exception lasts to the end of that day, UTC.
6. Select **Request exception**.

The console confirms with **Exception requested. It suppresses nothing until
somebody else approves it.** The request is recorded in the audit log.

## Approve or revoke an exception

1. Select **Compliance** > **Exceptions**. The page opens on the **In force**
   view.
2. Choose the **Waiting for approval** view to see requests.
3. Read the **Justification**, **Scope**, and **Expires** columns.
4. Select **Approve**. If the button is unavailable, the reason is shown under
   it. For example, you requested this exception yourself.

The console confirms with **Approved the exception on** the setting key, and
the date until which it suppresses the finding.

To withdraw an exception before it expires, select **Revoke** on its row. The
finding is live again at once. Every approval and revocation is recorded in the
audit log with the person who made it.

### Views

| View | Shows |
| --- | --- |
| **In force** | Active exceptions, soonest to expire first. The default. |
| **Waiting for approval** | Pending requests, oldest first. A pending exception suppresses nothing. |
| **Lapsed** | Exceptions that reached their expiry date. |
| **Withdrawn** | Exceptions someone revoked. |
| **Every decision ever recorded** | The whole register. |

You can also filter by **Status**, **Framework**, **Scope**, and **Setting
key**, and search the justification and setting key.

### Statuses

| Status | Meaning |
| --- | --- |
| **Pending approval** | Requested, not yet approved. The finding still counts. |
| **Active** | Approved and not expired. Covered endpoints show **Excepted**. |
| **Expired** | Past its expiry date. The finding counts again. |
| **Revoked** | Withdrawn by someone before it expired. |

An exception's status changes to **Expired** the moment its date passes.

## Verify

Open the control the exception covers. Endpoints in its scope show
**Excepted** with **See the exception**. The framework's percentage leaves
excepted verdicts out of both halves, and the **Excepted** count increases. An
exception never turns a gap into **Compliant**.

## If something goes wrong

| Symptom | Cause | Fix |
| --- | --- | --- |
| **An exception has to be approved by somebody other than the operator who requested it.** | You requested it. | Ask another person with `compliance:manage` to approve it. |
| **Deciding on compliance findings needs the compliance:manage permission, which your account does not have.** | Your role does not include `compliance:manage`. | Ask an owner or Support Manager to approve it. |
| **The expiry date cannot be more than a year away, so that every exception is reviewed at least annually.** | The date is more than a year out. | Choose an earlier date, and request a new exception when it lapses. |
| **A scope id is required for this scope type. Without one the exception would cover the whole fleet.** | You chose `site`, `device_group`, or `endpoint` without an ID. | Enter the ID, or choose `tenant`. |

## Next steps

- [Generate evidence packs](/compliance/evidence-packs/). Each pack lists the
  exceptions in force or decided during its period, with justification,
  requester, approver, and dates.
- [Review compliance posture](/compliance/compliance-overview/)