tegwick
f7f440dfff
Add six illustrative decisions and the pressure note, and open DECISION-WP-0003 for the kernel proposal. Assistant: grok Assistant-Session: 01a1082a-858c-7fe2-9b5a-0b5332107eb3
57 lines
1.8 KiB
Markdown
57 lines
1.8 KiB
Markdown
# DEC-EX-004 — Time-bounded scanning exception
|
|
|
|
Situation: security exception.
|
|
|
|
A migration needs a few days without malware scanning on one batch job. The exception is a decision, an authorization effect, and a relationship to the deploy policy in `DEC-EX-005`. Expiry is recorded in every place the draft offers a time bound.
|
|
|
|
```yaml
|
|
decision:
|
|
identity:
|
|
id: DEC-EX-004
|
|
title: Time-bounded exception for the partner upload
|
|
namespace: decision-canon/examples
|
|
question:
|
|
text: May the partner-upload job skip malware scanning until Friday so this migration can finish?
|
|
decision_class: security-exception
|
|
kind:
|
|
primary: exception
|
|
secondary:
|
|
- authorization
|
|
state:
|
|
lifecycle: effective
|
|
since: "2026-06-01"
|
|
governance:
|
|
owner: security owner
|
|
authority:
|
|
source: DEC-EX-005
|
|
scope: The partner-upload batch job, for this migration only.
|
|
may: Grant a scanning exception of at most five days.
|
|
must: Name an expiry and a residual control.
|
|
approvers:
|
|
- security owner
|
|
affected_parties:
|
|
- the team that receives the uploaded files
|
|
commitment:
|
|
selected: Skip malware scanning until 2026-06-05, and write only to the quarantine bucket.
|
|
by: security owner
|
|
at: "2026-06-01"
|
|
mode: approved
|
|
conditions:
|
|
- The exception ends at 2026-06-05T00:00:00Z even if the migration is unfinished.
|
|
effects:
|
|
- id: e1
|
|
type: authorization
|
|
target: partner-upload batch job
|
|
value: Skip malware scanning. Write objects only to the quarantine bucket.
|
|
effective_when: "2026-06-01T00:00:00Z"
|
|
expires_when: "2026-06-05T00:00:00Z"
|
|
relationships:
|
|
- type: exception-to
|
|
target: DEC-EX-005
|
|
temporal:
|
|
decision_time: "2026-06-01"
|
|
effective_from: "2026-06-01"
|
|
effective_until: "2026-06-05"
|
|
metadata:
|
|
formality_level: D4
|
|
```
|