Exception register

Approved exceptions to guardrails: which guardrail, for which service, who owns it and when it ends. Publishing them shows where guardrails do not fit, and keeps exceptions time-limited.

Exceptions are approved through the exception process. Every exception has an owner and an expiry date. The guardrails health page shows trends, such as guardrails that keep needing exceptions.

To be confirmed

TODO: whether Defra will publish its exception register in the open, which exceptions are recorded here (for example Must guardrails only), and how security exceptions are kept out of the public register.

The register never includes security vulnerabilities or anything else that would help an attacker - only the guardrail, the service, the owner and the dates. Security risk acceptances follow the security exception process and are not published.

No exceptions have been recorded in the published register yet.

The register is maintained in registers/exceptions.yaml. Add an approved exception there by pull request.