Documentation / Practices
Access and exceptions
Follow a request from intended purpose to review and expiry.
Purpose
Review the requested purpose against classification and the current contract. The steward prepares the assessment; the authorised owner decides. A technical custodian implements the approved policy. Approval and implementation are separate acts, and both need evidence. Denial and escalation should carry a reason rather than an unexplained status.
Working sequence
- Consumer: Requests a version and states the intended use.
- Steward: Checks purpose, meaning, classification and fit.
- Owner: Approves, rejects or escalates with a recorded reason.
- Custodian: Implements the authorised policy and verifies access.
- Consumer + owner: Review use, expiry, exceptions and continued need.
Local adaptation
An exception records the affected rule, business reason, risk, accountable approver, compensating control and expiry or review date. An exception is not a permanent shortcut around the baseline. Revoke access when its authorised purpose or period ends and retain an appropriate decision trail.
Review questions
- Who can decide, and is the acting role explicit?
- What rule or agreement authorises the action?
- What evidence demonstrates execution and its limitations?
- When will the outcome or exception be reviewed?
Continue reading
Original KDV Framework knowledge. Working community edition 0.1. CC BY 4.0. References retain their owners’ rights; no official assessment or certification is implied.