How should organizations handle exceptions to access policies?

• A. Document justification, manager approval, temporary tokens, and enforcement of expiration.
• B. Erase policies for exceptions.
• C. Grant permanent access for all exceptions.
• D. Notify security after the fact but no approval.

Answer: (A)

Exceptions to access policies must be controlled and auditable. When an exception is needed, the organization should document the justification, obtain manager-level approval, issue a temporary elevated credential, and enforce an expiration. This approach preserves the principle of least privilege while still enabling necessary work, and it creates a clear, auditable trail showing who approved the access, why it was granted, and when it will end. Temporary tokens help reduce the risk of ongoing over-privilege and allow revocation if the situation changes; automatic expiration ensures the exception doesn’t become permanent without renewed review.

Erasing policies for exceptions removes critical guardrails and creates inconsistency and ambiguity about what is allowed. Granting permanent access for all exceptions eliminates accountability and undermines security principles. Notifying security after the fact but without any upfront approval bypasses proactive governance, leaves a gap in control, and makes it hard to track approvals or detect misuse.