standard: security-zone-exceptions_v0.1
exceptions:
  - exception_id: zone-exc-fixture-001
    security_zone: z2-protected
    control: flex-auth/pre-sign
    workloads: [issue-core]
    base: {stance: enforced, failure_mode: fail_closed}
    relaxation: {stance: advisory}
    justification: bounded migration fixture
    requested_by: issue-core
    granted_by: ops-warden/security-owner
    issued_at: "2026-08-23T09:00:00Z"
    not_before: "2026-08-23T10:00:00Z"
    not_after: "2026-08-23T12:00:00Z"
    maximum_duration_policy: ops-warden/security-zone-exceptions@1
    change_ref: ops-warden@fixture
    durable_authorities:
      - id: ssh-cert:fixture
        not_after: "2026-08-23T11:00:00Z"