A department director verbally waived a retention rule for a one-off research extract, and months later no one can prove what was allowed. What should governance require for exceptions?

Policy exceptions must be controlled assets: recorded scope, approving authority, rationale, and expiry or review date. Verbal grants create unverifiable practice and invite policy drift. Operating models should route exception requests through a documented path so compliance and stewards can reconstruct what was permitted and when it ends.