> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/use-sto/sto-exempt-issues/manage-exemptions.md).

# Manage Issue Exemption Requests

This document details how issue exemption requests can be reviewed and processed by security teams(reviewers). It walks through the complete lifecycle of an exemption request, the permissions required to take action, and how exemptions can be applied at different scope - **Project**, **Organization**, or **Account**.

The reviewer's role must include **Approve/Reject** permissions for Exemptions at the appropriate scope, whether at the **Project**, **Organization**, or **Account** level. Refer to [Required permissions for issue exemptions](/security-testing-orchestration/use-sto/sto-exempt-issues/issue-exemption-workflow.md#required-permissions-for-issue-exemptions) and ensure you have the required privileges at the required scopes.

{% embed url="<https://youtu.be/QP78FN-wNkI>" %}

### Issue Exemption lifecycle <a href="#issue-exemption-lifecycle" id="issue-exemption-lifecycle"></a>

An Issue Exemption request in STO follows a defined lifecycle, with actions that can be taken at each stage. The actions to address exemption requests include **Approve**, **Reject**, **Cancel**, and **Re-open** (to re-open any expired, rejected requests).

The lifecycle stages are as follows:

1. **Pending:** The request is newly created and awaits review. At this stage, users can choose to approve, reject, or cancel the request.
2. **Approved:** The request has been reviewed and accepted. The issue is temporarily or permanently exempt from further action based on the exemption details.
3. **Rejected:** The request has been reviewed and denied. The issue remains active, and the pipeline may continue to block due to OPA policy enforcement failures.
4. **Expired:** The exemption period has elapsed. Once expired, the issue returns to its original active state unless a new exemption is requested.

**Expired** and **Rejected** exemption requests with **Organization** or **Account** scope can only be moved to **Approved** by approving; those with **Project**, **Pipeline**, or **Target** scope can be moved to Pending by re-opening.

<figure><img src="/files/kqmv0zOam8BvOFZBwgde" alt=""><figcaption><p>Click to view full size image</p></figcaption></figure>

{% hint style="info" %}
Users with the [**Security Testing AppSec**](/security-testing-orchestration/use-sto/sto-exempt-issues/issue-exemption-workflow.md#default-roles-and-permissions) role can approve or manage issue exemption requests. Refer to [Required permissions for issue exemptions](/security-testing-orchestration/use-sto/sto-exempt-issues/issue-exemption-workflow.md#required-permissions-for-issue-exemptions) to learn more.
{% endhint %}

### Approve, Reject, or Cancel an Exemption Request <a href="#approve-reject-or-cancel-an-exemption-request" id="approve-reject-or-cancel-an-exemption-request"></a>

Each exemption request is associated with a specific scope, either a **Pipeline**, **Target**, or **Project**. Reviewers can approve the exemption at the requested scope or at a broader level, such as **Organization** or **Account**, as long as they have the appropriate permissions. Refer to the [Required permissions for issue exemptions](/security-testing-orchestration/use-sto/sto-exempt-issues/issue-exemption-workflow.md#required-permissions-for-issue-exemptions) for more details.

<figure><img src="/files/v4aRjw5wYbmUc9xwHQm0" alt=""><figcaption><p>Click to view full size image</p></figcaption></figure>

You can act on exemption requests from the **Exemptions** section, available at the [**Project**](/security-testing-orchestration/use-sto/sto-exempt-issues/exemption-workflows.md#view-exemptions-at-the-project-level), [**Organization**](/security-testing-orchestration/use-sto/sto-exempt-issues/exemption-workflows.md#view-exemptions-at-the-organization-level), and [**Account**](/security-testing-orchestration/use-sto/sto-exempt-issues/exemption-workflows.md#view-exemptions-at-the-account-level) levels. Reviewing from higher scopes (**Organization** or **Account**) provides a broader view, allowing you to manage exemptions across all organizations and projects within.

{% hint style="warning" %}
In the **Exemptions** section at the [**Organization**](/security-testing-orchestration/use-sto/sto-exempt-issues/exemption-workflows.md#view-exemptions-at-the-organization-level) or [**Account**](/security-testing-orchestration/use-sto/sto-exempt-issues/exemption-workflows.md#view-exemptions-at-the-organization-level) level, you can only see exemption requests from projects where you have View permissions. However, if you have **Approve/Reject** permissions at the [**Organization**](/security-testing-orchestration/use-sto/sto-exempt-issues/issue-exemption-workflow.md#required-permissions-for-issue-exemptions) or [**Account**](/security-testing-orchestration/use-sto/sto-exempt-issues/issue-exemption-workflow.md#required-permissions-for-issue-exemptions) level and you approve an exemption at that scope, it will be applied to all organizations and projects under it, even to those you don’t have access to.
{% endhint %}

#### Approve an Exemption Request <a href="#approve-an-exemption-request" id="approve-an-exemption-request"></a>

To approve an exemption request:

1. Go to **Exemptions** section from the left navigation.
2. Select **Pending** tab.
3. Click on the exemption request you want to act on. The **Exemption Details** pane opens on the right.
4. Based on your [permissions](/security-testing-orchestration/use-sto/sto-exempt-issues/issue-exemption-workflow.md#required-permissions-for-issue-exemptions), you will see the actions available to you.

You can approve the exemption at the requested scope or a higher one:

* **Approve for this target** – Applies the exemption only to the specific target where the issue was found.
* **Approve for this pipeline** – Applies the exemption only to the specific pipeline where the issue was found.
* **Approve for this project** – Applies the exemption to all pipelines and targets in the current project.
* **Approve for this organization** – Applies the exemption across all projects in the organization requires [`Approve/Reject`](/security-testing-orchestration/use-sto/sto-exempt-issues/issue-exemption-workflow.md#required-permissions-for-issue-exemptions)\` permission at the Organization scope.
* **Approve for this account** – Applies the exemption across all organizations and projects in the account requires [`Approve/Reject`](/security-testing-orchestration/use-sto/sto-exempt-issues/issue-exemption-workflow.md#required-permissions-for-issue-exemptions) permission at the Account scope.

When you click on an **Approve** action, a window appears displaying details such as the Issue Title, Requested Scope, **Requested Duration** (the time period originally requested by the submitter, e.g., 7 Days, 30 Days, All Time), **Approval Duration** (the time period you want to grant for the exemption, with preset options or custom duration in days), and an optional **Comment** field. Review the request details, adjust the approval duration if needed, add a comment, and click **Submit** to proceed.

The exemption pane shows the latest comment inline. For the complete history of actions taken on this exemption, including who requested, approved, rejected, canceled, or re-opened it and when, click **Exemption Log**. For more information, see [View the exemption log](/security-testing-orchestration/use-sto/sto-exempt-issues/exemption-workflows.md#view-the-exemption-log).

{% hint style="info" %}

* Always review the **Exemption Details** and consider the **Requested Duration** before approving. The exemption remains active only for the specified time window (e.g., 7 days from the approval date).
* You can configure notifications to alert users when the status of an exemption changes. For more details, see [Notifications for Exemptions](/security-testing-orchestration/use-sto/sto-set-notifications/exemption-notifications.md).
  {% endhint %}

<figure><img src="/files/4941EyFMhEzUpQaFpRTK" alt=""><figcaption><p>Click to view full size image</p></figcaption></figure>

<figure><img src="/files/VUSlR5RLwsPI1I8xGtp2" alt=""><figcaption><p>Click to view full size image</p></figcaption></figure>

**Users Can Approve Their Own Exemptions**

You can control whether users are allowed to approve or reject their own exemption requests. This option is available under **Exemption Settings** on the **Default Settings** page at the **Project**, **Organization**, and **Account** levels. To configure this setting, you must have Admin-level permissions at the respective scope.

#### Reject an Exemption Request <a href="#reject-an-exemption-request" id="reject-an-exemption-request"></a>

To reject an exemption request, you can either use the **Reject** action directly from the **Exemptions** section or click the request to open the **Exemption Details** pane, where you can review the request thoroughly before choosing to **Reject** it.

When you click on the **Reject** action, a window appears displaying details such as the Issue Title, Requested Scope, and an optional **Comment** field. You can review the request details, add a comment if needed, and click **Submit** to proceed.

The exemption pane shows the latest comment inline. For the complete history of actions taken on this exemption, including who requested, approved, rejected, canceled, or re-opened it and when, click **Exemption Log**. For more information, see [View the exemption log](/security-testing-orchestration/use-sto/sto-exempt-issues/exemption-workflows.md#view-the-exemption-log).

<figure><img src="/files/O3wLC1HYLjOmo3waEr9z" alt=""><figcaption><p>Click to view full size image</p></figcaption></figure>

<figure><img src="/files/Faw04nzgwBWMOJ8HaAQC" alt=""><figcaption><p>Click to view full size image</p></figcaption></figure>

Once rejected, the request moves to the **Rejected** tab. The associated issue remains active and may continue to block pipelines due to OPA policy enforcement failures. For more information, see the [**Issue Exemption Lifecycle**](#issue-exemption-lifecycle).

#### Cancel an Exemption Request <a href="#cancel-an-exemption-request" id="cancel-an-exemption-request"></a>

Clicking **Cancel** on an exemption request immediately removes it from the system. Once canceled, the request no longer appears in the **Exemptions** section. If the exemption is still needed, a new request must be created. The cancellation itself remains visible in the **Exemption Log** even after the request drops off the active list.

### Best Practices <a href="#best-practices" id="best-practices"></a>

* A user with the [Security Testing AppSec](/security-testing-orchestration/troubleshooting-and-resources/rbac.md) role should periodically review all exemptions and update their statuses as needed.
* Always [define a baseline for every target](/security-testing-orchestration/new-to-sto/key-concepts/targets-and-baselines.md#every-target-needs-a-baseline). If a target doesn’t have a baseline, exemption details won’t be visible. Instead, you’ll see a link prompting you to define the target’s baseline.

  <figure><img src="/files/e5F4v2xmp8ivmhMRVcfv" alt="Can&#x27;t view exemption details because the target has no baseline"><figcaption></figcaption></figure>
* You can view the **Time Remaining** for approved exemptions and the **Requested Duration** for pending, rejected, and expired requests.