Waiver

packs:security-governance

A waiver is one entry of the exceptions register: a time-boxed, justified exception against a control, optionally scoped to an estate path. Waivers are never self-granted — the recording caller becomes approved_by and is always distinct from requested_by — and never renew in place: renewal is review-before-renewal, a new waiver. Served by the v2 GovernanceService: CreateWaiver and ListWaivers.

Waiver

Waiver is one exceptions-register entry: time-boxed, reasoned, never self-granted.

Field	Type	Meaning
approved_by	string	Who granted it — the recording caller, never requested_by.
control_id	string	The control the exception is recorded against.
created_at	timestamp	When the record was created.
expires_at	timestamp	Mandatory expiry; renewal is review-before-renewal, a new waiver.
external_ref	string	A typed external reference (ticket, approval record).
id	string	The record's identity.
justification	string	Why the exception is warranted (mandatory).
requested_by	string	Who asked for the exception.
scope_path	string	The estate path the waiver is scoped to; empty scopes it to the control.
updated_at	timestamp	When the record was last updated.

ExternalReference

ExternalReference is one typed governance reference.

Field	Type	Meaning
id	string	The record's identity.
record_type	string	"change" | "incident" | "issue" | "problem" | "release" | "request" | "task".
relationship	string	"implements" | "resolves" | "caused" | "relates_to".
system	string	The referenced system, e.g. "JSM".
url	string	A link to the referenced record, when the referencing system has one.

Related pages

• opschain docs governance — the controls register and where the exceptions register sits in it.
• opschain docs resources/control — what a waiver is recorded against.
• opschain docs packs-security-governance — the entitlement that serves this register.