A policy exception is a formally approved, time-bound deviation from an access or governance rule. A valid exception records the business reason, affected identities and resources, risk acceptance, compensating controls, approver and expiry date.
Exceptions should be visible in requests and reviews and should expire automatically unless explicitly renewed. An undocumented bypass is not an exception process.