Create a policy exception
Request an approved, time-bound deviation from a policy or control objective that applies to an AI asset, supported by a justification and a risk assessment.
Before you begin
Role required: sn_ai_governance.ai_steward or sn_ai_asset_mgmt.ai_asset_owner
About this task
A policy exception documents why an AI asset can't currently meet a control objective and requests approval to operate outside that control for a defined period. The exception routes to an approver, who reviews your justification and risk assessment before approving or rejecting the request.
Procedure
- Navigate to All > AI Control Tower > Home > Activity Center > Work > Assigned to you.
- Select the Policy exceptions sub-tab.
- Select New.
-
Fill in the fields that describe the exception.
Table 1. Policy exception fields Field Description Name Name of the policy exception. Requester User requesting the exception. Defaults to you. State Current state of the exception. Defaults to New. Reason Reason for requesting the exception. Priority Priority of the exception request. Justification Justification for requesting the exception. Note:The Substate field populates automatically as the exception moves through review, such as Under review or Pending risk assessment, and isn't set when you create the exception. -
In the Source section, identify the policy or control the exception applies
to.
Table 2. Source fields Field Description Source type Type of source the exception applies to. Policy Policy that the exception applies to. Control objective Control objective that the exception applies to. When Source type is set to Control objective, select the control objective first, then select the specific controls from the impacted controls list. -
In the Schedule section, set how long the exception is valid for.
Table 3. Schedule fields Field Description Valid from Date and time the exception takes effect. Valid to Date and time the exception expires. Note:The Duration field is calculated automatically from the Valid from and Valid to dates and isn't set directly. -
In the Assignment section, specify who should review the exception.
Table 4. Assignment fields Field Description Watch list Users who want to stay informed about the exception. Approval group Group responsible for approving the exception. Approver User responsible for approving the exception. -
In the Risk assessment section, document the risk that the exception
introduces.
Table 5. Risk assessment fields Field Description Method Method used to determine the risk rating. Risk rating Risk rating assigned to the exception. Risk description Description of the risk associated with the exception. Analysis of risk and impact Analysis of the risk and its potential impact. Risk mitigation plan Plan for mitigating the risk while the exception is in effect. -
In the Confidentiality section, restrict visibility of the exception if
needed.
Table 6. Confidentiality fields Field Description Confidential Restricts visibility of the exception to confidential users and members of confidential user groups. Allowed users Users who can access the exception if it's marked confidential. Allowed groups Groups who can access the exception if it's marked confidential. -
In the Comments section, add any supporting notes.
Table 7. Comments fields Field Description Work notes (Private) Internal notes about the exception that aren't visible to the customer. Additional comments (Customer visible) Comments about the exception that are visible to the customer. -
In the Settings section, specify the functional domain that the exception belongs to.
Table 8. Settings fields Field Description Functional domain Functional domain that the exception belongs to, such as AI Risk and Compliance or IT risk and compliance. - Save the policy exception.
Result
The policy exception is created and routes to the assigned approver for review. The exception appears in the Policy exceptions sub-tab, where you can track its status.