AI Safety Policy Exception Governance: Expiring Leases, Compensating Controls, and Review Watermarks

"Let's add this customer to the allowlist and handle it next week" often survives for years. The models, data classifications, and owners have all changed, yet the boolean field still lets every request bypass the new rules. NIST SP 800-37 places risk management in a continuous lifecycle, and SP 800-53 also emphasizes control assessment and continuous monitoring; AI platforms need to make exceptions into security objects that naturally expire, rather than notes scattered across code and tickets.

The Agent human approval gate authorizes a single specific action, and Agent approval anti-replay limits how many times that approval can be consumed. Policy exceptions are different: they allow a class of requests to deviate from baseline controls for a limited time and may be used many times, so scope, risk, and revocation must be managed independently.

An Exception Is a Closed Lease

safetyExceptionLease.v1 records at least the exception ID, lineageKey = H(control, scopeDigest), head generation, the deviated control/policy, the normalized scope, risk notes, owner/approver, compensating control probes, start and hard expiry, maximum usage, issuance epoch, policy floor, predecessor, and signature. The scope lists tenant, environment, use case, models, action, data classes, regions, and resources; empty values are not wildcards.

schema: safetyExceptionLease.v1
exceptionId: exc_01JZ9A
control: output.pii.block@6
scope:
  tenant: tenant-42
  environment: production
  useCase: regulated-document-redaction
  models: [model-release-81]
  dataClasses: [synthetic-pii-fixture]
compensatingControls:
  - { id: isolated-sandbox@3, freshnessSlo: 60s }
  - { id: no-external-egress@2, freshnessSlo: 30s }
startsAt: 2026-07-19T00:00:00Z
expiresAt: 2026-07-26T00:00:00Z
maxUsages: 500
issuanceEpoch: 918
policyFloor: safety-policy@44

Some baselines are marked NON_WAIVABLE, such as cross-tenant data exposure, and the exception service does not issue leases for them at all. Compensating controls are not boilerplate: each control provides a machine probe with a time watermark; if a probe is stale, its state is unknown, or it is below the required version, the lease does not apply. The risk acceptor cannot also serve as the sole technical validator, and high-risk scopes should additionally require organizationally defined two-person separation of duties.

Expiry and Revocation Must Enter the Execution Path

The state machine is DRAFT -> REVIEWED -> SCHEDULED -> ACTIVE -> EXPIRING -> EXPIRED, and any active state can transition to REVOKED. Time checks use a trusted server-side clock; when the clock is unavailable, the revocation watermark is stale, or the exception service is unreachable, it falls back to the baseline policy instead of continuing to use the local cache. Expiry has no automatic grace period. Notifications 30, 14, and 7 days in advance only drive migration; they do not extend expiresAt.

At runtime, the baseline policy is computed first, then the lease is looked up by scope, validating signature, state, policy floor, owner, compensating probes, and quota. The acceptance point atomically reserves usage, binds the execution, requires the lease generation to equal the lineage's active head, and then writes the exception ID into the AI runtime safety decision receipt; if any step fails, nothing executes. A failure is settled against the same execution and cannot draw a separate quota.

Revocation bumps the exception epoch and requires all readers to observe the new watermark within the SLO; caches may only shorten the availability window and cannot override the hard expiry. If a policy upgrade touches a lease's control or scope semantics, the policy floor is bumped to invalidate old leases. RAG authorization revocation propagation handles member and document permission tightening; the exception system reuses its 'unknown means not authorized' principle but does not take over business ACLs.

Renewal Creates a Successor, Not Rewrites History

Review covers usage, probe gaps, incidents, alternative approaches, residual risk, and policy diff. The registry maintains a single current head for the canonical lineage: an initial lease can only be CAS-created when there is no head, and renewal CAS-moves the head to a single SCHEDULED successor, with startsAt = previous expiresAt by default; if switching early, the old generation must be atomically revoked and the new generation activated. Opening another predecessor=null root for the same scope conflicts, and retries return the existing result; historical leases are not rewritten.

Quantitative gates may stipulate: zero active leases without an owner, approver, or healthy compensating control; zero accepted executions produced by an expired or revoked lease; severe-risk leases at most 7 days and other leases at most 30 days; revocation propagation p99 under 60 seconds; 100% of exception executions have a usage receipt; 100% of renewals reference a complete observation window, and any scope expansion must be re-approved. Terms are frozen by the organization based on risk, and silencing alerts does not count as passing.

Fault injection covers clock rollback, two requests bypassing the predecessor to create new roots, duplicate renewals, scope Unicode confusion, owner departure, false-green probes, a race between the last usage and successor activation, policy floor bumps, and treating empty arrays as wildcards. The expectation is to fall back to the baseline or return EXCEPTION_NOT_APPLICABLE, never fail-open. AI cloud control plane audit integrity records changes, and business assertions still directly verify that the action was not executed.

Migration starts by inventorying code allowlists, database flags, and ops runbooks, compiling them into candidate leases that are disabled by default; a shadow evaluator reports, for at least one full business cycle, the reasons why the old path allowed while the new lease denied. Then enable only one low-risk use case and expand tenant by tenant. On anomaly, the reader falls back to the previous parser version but continues to obey the current epoch, hard expiry, and policy floor; never roll back a database snapshot to revive a revoked lease. AI feature flagging and Feature Flag can turn off the new exception entry point, while historical usage and risk-acceptance records remain immutable.