Set up an exception workflow
Let developers request exceptions when a rule blocks them, and let the team that owns your policy approve or deny each one.
Exception requests let developers ask for an exception when a rule blocks a package, and let the team that owns your policy approve or deny it. The reviewer can adjust the exception before approving, and every request and decision is recorded in the audit log.
This guide uses the dashboard. The API has the same operations.
Set up the reviewing team
Request exception is only offered to people who cannot add exceptions themselves, so first decide which team can. That team reviews the requests.
- Open Teams and create a team for the reviewers, such as
security, or open an existing one. Add its members and includefw:update:exceptionin its permissions. - Open the firewall's Access tab and add the team with
fw:update:exception. - On the same tab, remove
fw:update:exceptionfrom every other team, everybody included. A firewall created without an owner team gives every permission to everybody.
Both are needed. The team's permissions set the limit, and the Access tab applies it to this firewall. Developers keep fw:access, which lets them install packages and request exceptions.
Turn on exception requests
Requests are turned on per firewall.
- Open the firewall and select Edit.
- Switch on Exception requests and pick the reviewing team as the Notify team.
- Select Save.
The notify team is emailed about each new request. Child firewalls do not inherit the setting.
Request an exception
A developer asks for the exact exception they need, so the reviewer can decide without a back-and-forth.
- Open Logs and select the blocked request.
- Select Add exception. It opens as Request exception, with the rule, package, and version filled in.
- Narrow the scope if you can, and pick a Reason and an Expiration.
- Write a Justification: why you need the package and why the block does not apply.
- Select Request exception.
Requests come from a person, in the dashboard or with a personal access token. Service access tokens cannot request exceptions.
Review the request
Approving adds the exception for everyone who uses the firewall, so check the scope as well as the reason.
Open Exception requests in the main menu. The number next to it is how many requests are waiting for you, and Needs review lists them.
- To approve, adjust the exception if needed, for example by pinning one version or shortening the expiry, then select Approve and add exception. The exception propagates across the cluster within a few seconds. Other pending requests for the same exception are approved with it.
- To deny, write a Comment and select Deny. The requester sees the comment.
Follow up
The requester gets an email with the decision and any comment. After an approval, they install again.
Requesters can follow their requests under My requests on the Exception requests page, and Withdraw one that is no longer needed.
Connect your own tools
To post requests to a chat channel or open tickets for them, subscribe a webhook to exception-request.*. See Receive webhook events.
Troubleshooting
- Exception requests are off on this firewall. A child firewall needs its own setting.
- You do not have
fw:accesson the firewall. - You can already add exceptions, so you are offered Create exception instead.
- The rule was removed from the firewall.
If the rule was deleted after the request was made, deny or withdraw the request. If the rule is inherited, approving also needs fw:update:exception on the firewall that owns it.
The exception expired or was removed. Request a new one if the need remains.
Related
- Concept: Exception model
- How-to: Manage exceptions, Manage access, Receive webhook events
- Reference: Exception requests, Exceptions, Permissions
- API: Rules and exceptions