Security Exceptions Are Architecture Decisions with Expiration Dates

A security exception changes the effective architecture, so it needs an owner, bounded scope, compensating controls, verification evidence, and an enforced expiration path.