01/10 edition: an AI exception with expiry and revocation

A control failure grants no authority

An SME has an assistant preparing drafts from authorised documentation. Central log collection becomes unavailable. Product requests continuity; operations can keep the assistant running. The question is not whether someone accepts generic discomfort. It is which limited use may continue, with what evidence and under whose authority.

We propose treating this as an exception request to a specific internal control. It is not permission to bypass a legal obligation, contract or data restriction. If the team does not know whether the proposed use is permitted, an operating exception does not resolve that uncertainty.

What the references offer

NIST GOVERN 2.1 recommends documented responsibilities and communication lines. OWASP LLM06 recommends downstream authorisation. The AI RMF is voluntary. Our proposed duration, compensating control and revocation rule belong to the Velqory design; they are not deadlines imposed by these documents.

Reduce scope before seeking approval

The proposal retains only draft production using synthetic material or material previously authorised for that workflow. It removes writing and sending tools, retains human confirmation and manually records each task in an approved medium. The team must establish whether it can keep that record without creating another content exposure.

The request identifies the affected control, reason, permitted operations, excluded data and ending condition. It names the evidence collector and an available deputy. Compensation does not automatically become equivalent to the original control; the decision-maker should see the remaining gap and the alternative of suspending the service completely.

Approve a window, not an intention

We propose that the service owner requests the exception and the control owner assesses it within authority previously assigned by the organisation. Authorisation names the start, end and task set. Without verifiable validity, the operator lacks a sufficient basis to continue.

Hypothetical scenario: a new, out-of-scope dossier arrives during the approved window. The expected response is to refuse it or suspend the workflow, not rewrite the request to pretend it was already included. Expansion requires a new decision. The matrix does not grant power through a job title alone; it assumes demonstrable internal authority.

Prove expiry and revocation

The matrix is original and untested. We propose a synthetic-task trial: one within the window, one after its end and one after early revocation. The record should show refusal of a new task, not merely a status change in the exception document.

Close the exception without normalising it

Restoring the original control requires checking log collection and reconciling manually recorded tasks. Identify gaps that cannot be reconstructed; do not retrospectively fill events as if observed. The control owner confirms closure and remaining actions.

For a Portuguese SME, the benefit is readable authority during failure. If the same cause returns, the new request should expose recurrence and the option of reducing or withdrawing the service. We do not propose silent renewal. This analysis proves neither legal compliance nor compensating-control effectiveness; it offers a bounded decision the team still needs to test.