10.4 Waivers — the exceptions register

Included from Basic tier

After this you can: grant a time-boxed, never self-granted waiver, cite it from a change, and read the register.

Before you start — tick each one:

• Lesson 10.1 — Approval policies and the change funnel (opschain learn 10.1)

In the GUI: Governance → Evidence & controls — the waivers register beside the control catalog and the evidence ledger.

Sometimes a control legitimately cannot be met: a legacy system that cannot take the patch cadence, a vendor contract that delays an enforcement rollout. The honest answer is neither to ignore the control nor to quietly retire it, but to record a waiver: time-boxed, reasoned, scoped, and never self-granted. The register of current waivers is the auditor's answer to "what are you knowingly not doing, and until when?" The model reference is opschain docs governance.

Who can do this. Granting a waiver is an admin-plane act on the step-up floor (opschain learn 7.4). Reading the register is user-plane: a path-RBAC grant of readable on /governance/waivers. Waivers are base platform — no pack entitlement is required.

1. Grant a waiver

A waiver cites a control (create one first — lesson 11.2), carries a mandatory future expiry, a justification, who asked, and optionally an estate scope and a typed external reference. As an admin (elevated):

opschain admin governance waivers create \
  --control prod-change-approval \
  --justification "LimeTel SIP core vendor freeze until contract renewal" \
  --requested-by jessica \
  --expires 2027-01-31T00:00:00Z \
  --scope-path /projects/limetel/environments/prod/assets/sip_core \
  --external-ref "JSM:change:CHG-1107"

granted waiver 01a2f7c0-2b1a-7d04-8e3f-4a5b6c7d8e9f on control 01a2f0e0-… — expires 2027-01-31T00:00:00Z

Two shapes are enforced, not advisory:

• Time-boxed. --expires is mandatory and must be in the future. Renewal is review-before-renewal: a new waiver, never an extended one.
• Never self-granted. The recording caller is the approver and must differ from --requested-by — refused at the API and by a schema constraint. Granting your own exception is structurally impossible.

2. Read the register

opschain governance waivers list

ID                                    CONTROL     SCOPE                                                REQUESTED BY  APPROVED BY  EXPIRES AT            JUSTIFICATION
01a2f7c0-2b1a-7d04-8e3f-4a5b6c7d8e9f  01a2f0e0-…  /projects/limetel/environments/prod/assets/sip_core  jessica       ryan         2027-01-31T00:00:00Z  LimeTel SIP core vendor freeze until contract renewal

The register lists soonest expiry first — the top of the list is what needs re-review next. Every grant is audited:

opschain audit --type api:governance_waivers:create

3. Cite waivers as evidence

A waiver is a typed evidence kind: an attestation that verified a control with exceptions should cite the waivers excusing them:

opschain governance evidence attest --control prod-change-approval \
  --verdict verified_with_exceptions \
  --evidence waiver:<waiver-id> \
  --notes "Funnel verified; SIP core waived until vendor contract renewal"

attestation appended — seq 58 (sha256:3c7a…9f1e)

4. Waivers are not break-glass

The two exception shapes are deliberately distinct:

• A waiver excuses a control for a scope and a period — granted in advance, reviewed on expiry.
• Break-glass (lesson 10.1) is an authentication/release posture for one subject at 2 a.m. — used in the moment, loud by design.

If you find waivers being granted during incidents, you wanted break-glass; if you find break-glass firing weekly for the same system, you wanted a waiver — and the audit stream will show you both.

Check yourself

• Who may grant a waiver to themselves, and what does the register list first? Then: which verdict does an attestation that cites a waiver carry?

What you learned

• A waiver is a first-class, queryable record: time-boxed, scoped, reasoned, never self-granted — enforced by the API and the schema.
• The register (opschain governance waivers list) reads soonest expiry first; grants are admin + step-up, audited.
• Attestations cite waivers by id, closing the loop between "what we committed to" and "what we knowingly deferred".

Next: this closes the module Change governance — back to your track (opschain learn).