# Exception-Governance Review Checklist

The per-concern checklist applied to every recorded or reviewed policy exception.

- Owner: the exception has a named owner distinct from the requester.
- Scope: the exception records an explicit, bounded scope.
- Expiration: the exception records an expiration date.
- Compensating control: the exception records a compensating control.
- Review date: the exception records a review date.
- Self-approval: the agent never approves its own exception or one it would benefit from.