> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/software-supply-chain-assurance/use-scs/open-source-management/manage-exemption-requests.md).

# Manage Exemption Requests

Create, review, and track SBOM dependency exemption requests in Supply Chain Security.

Supply Chain Security (SCS) helps you identify software components or dependencies that violate your organization's security, compliance, and licensing policies. However, there are situations where a blocked dependency may still need to be used temporarily. For example, no fixed version may be available, or the risk may have been assessed and accepted. Without an exemption workflow, organizations must either enforce policies and block development or relax the policies entirely. This increases security and compliance risks.

SBOM dependency exemptions provide a controlled way to make policy exceptions for specific software components or dependencies. Instead of modifying the underlying SBOM policy, exemptions apply only to the selected dependency. This enables organizations to accommodate approved exceptions while maintaining governance and compliance. Developers can request exemptions, and security approvers can review and manage them through a centralized approval workflow.

***

### What will you learn in this topic? <a href="#what-will-you-learn-in-this-topic" id="what-will-you-learn-in-this-topic"></a>

By the end of this topic, you will be able to:

* Understand SBOM dependency exemptions and how they work.
* Create and manage dependency exemption requests for SBOM policy violations.
* Review exemption requests across the Pending, Approved, Rejected, and Expired states.
* Filter exemption requests and identify exempted dependencies in the SBOM.

***

### Before you begin <a href="#before-you-begin" id="before-you-begin"></a>

Make a note of the following before you proceed with managing exemption requests in SCS:

* Make sure that your source code management (SCM) provider is integrated with the platform to generate SBOMs for your code repositories. You can do this in one of the following ways:
  * Repository onboarding through RSPM currently supports GitHub and Bitbucket:
    * To integrate your GitHub account and onboard the repositories, go to [Onboard GitHub Repositories](https://developer.harness.io/docs/software-supply-chain-assurance/open-source-management/integrations/github).
    * To integrate your Bitbucket account and onboard the repositories, go to [Onboard Bitbucket Repositories](https://developer.harness.io/docs/software-supply-chain-assurance/open-source-management/integrations/bitbucket).
  * SBOMs can be generated through pipeline execution. To generate SBOM via pipeline execution, refer to the [Generate SBOM for Repositories](https://developer.harness.io/docs/software-supply-chain-assurance/open-source-management/generate-sbom-for-repositories) documentation.
* Make sure that SBOMs are generated for your container artifacts. For more information, go to [Generate SBOM for Artifacts](https://developer.harness.io/docs/software-supply-chain-assurance/open-source-management/generate-sbom-for-artifacts).
* Make sure you have the appropriate roles and resource group permissions to view, create, approve, or reject an exemption request. For more information, go to [Supported SCS Resources and Permissions](https://developer.harness.io/docs/software-supply-chain-assurance/settings/rbac#supported-scs-resources-and-permissions).

***

### Understand SBOM dependency exemptions <a href="#understand-sbom-dependency-exemptions" id="understand-sbom-dependency-exemptions"></a>

An SBOM dependency exemption is a policy exception that allows a specific software component or dependency to bypass SBOM policy enforcement under defined conditions. Unlike modifying an SBOM policy, an exemption affects only the selected dependency and does not change how the policy is enforced for other dependencies. This allows organizations to address exceptions without reducing the effectiveness of their security and compliance policies.

Every exemption is defined by a set of attributes that determine how it is evaluated. These attributes include the exemption scope, version scope, duration, reason, and an optional justification. Together, they define where the exemption applies, which dependency versions it covers, how long it remains active, and the business or security context behind the exception.

Exemptions support multiple hierarchy levels, including the target, project, organization, and account scopes. They can also be configured to apply to a specific dependency version or to all versions of the dependency. All exemption activities are retained in the audit history, helping organizations maintain visibility, governance, and compliance across policy exceptions.

| Why use it?                                                                                                                                                                                                                  | When to use it?                                                                                                                                                                                                                                                                                                                           | How can you leverage it?                                                                                                                                                                                                                                                                                                                                                                  |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <ol><li>Limit the impact of policy exceptions.</li><li>Control where an exemption applies.</li><li>Control which dependency versions are exempted.</li><li>Ensure policy exceptions remain governed and auditable.</li></ol> | <ol><li>When only a specific dependency requires an exception.</li><li>When an exception should be limited to a target, project, organization, or account.</li><li>When an exemption should apply to a single version or every version of a dependency.</li><li>When exceptions require periodic review or compliance tracking.</li></ol> | <ol><li>Create an exemption for the affected dependency instead of modifying the policy.</li><li>Configure the exemption scope based on organizational requirements.</li><li>Configure the version scope to exempt either the selected dependency version or all versions of the dependency.</li><li>Configure the exemption duration and retain approval records for auditing.</li></ol> |

***

### SBOM dependency exemptions workflow <a href="#sbom-dependency-exemptions-workflow" id="sbom-dependency-exemptions-workflow"></a>

When a component or dependency violates an SBOM policy, developers can request an exemption directly from the dependency details in the SBOM. After the request is submitted, it enters the **Pending** state until a security approver reviews it. During the review process, the approver can approve or reject the request. If required, the approver can approve the exemption at a higher scope than originally requested. For example, a request submitted at the target scope can be approved at the project, organization, or account scope.

During policy evaluation, Harness checks for an active exemption before enforcing an SBOM policy. If a matching exemption exists and its scope and duration are valid, the policy violation is exempted. Otherwise, the policy is enforced as configured.

When an exemption expires, it is no longer considered during policy evaluation. If the dependency still violates a policy, a new exemption request must be submitted. If a dependency is already covered by an active exemption, the SBOM displays the exemption status and prevents duplicate exemption requests. Users can also view details such as the approver, justification, scope, and expiration date for the existing exemption.

***

### Create an exemption request

Creating an exemption request for a dependency allows you to continue using a software component or dependency while it undergoes review. To request an exemption, complete the following steps:

1. Navigate to the **Code Repositories** or **Artifacts** page under the **Supply Chain** section from the sidebar navigation of your SCS account and select your repository or artifact (along with the digest). The `Overview` tab opens by default.
2. Select the `SBOM` tab to view the list of dependencies in the form of a table.
3. Select the dependency for which you want to request an exemption to open the side panel.
4. Click the **Request Exemption** button on the top right of the side panel to open the **Request Exemption for \<dependency\_name>** dialog.
5. Select the appropriate radio button to specify the exemption scope for the dependency.
   * Choose **This Target** to apply the exemption only to the current target.
   * Choose **This Project** to apply the exemption across the project.
6. Select the appropriate radio button to specify the dependency version to exempt.
   * Choose **This Version (version\_number)** to apply the exemption only to the selected version of the dependency.
   * Choose **All Versions** to apply the exemption to all versions of the dependency.
7. Specify the exemption duration by selecting the preferred option from the dropdown list.\
   The available options are **7 days**, **30 days**, **180 days**, and **All time**.
8. Select the appropriate exemption reason from the dropdown list.\
   The available options are **Acceptable use**, **Acceptable risk**, **No fix available**, and **Others**.
9. (Optional) Enter a detailed description to provide additional context for the selected exemption reason.
10. (Optional) Enter any URL that provides additional context or supporting information for the exemption request.
11. Click **Create Request** to create the exemption request.

{% hint style="info" %}
Raising an exemption request for a target is only supported for artifacts and does not apply to repositories.
{% endhint %}

<figure><img src="https://234451070-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSN2B2M5cFWy0hhD0xTuE%2Fuploads%2Ft85zZeXwvEan7Xiuw9Jy%2Fcreate-exemption-request.png?alt=media&amp;token=5c95af46-d89c-4376-b59e-385a7d5931cf" alt="Create exemption request"><figcaption><p>Create exemption requests</p></figcaption></figure>

### Filter exemption requests <a href="#filter-exemption-requests" id="filter-exemption-requests"></a>

Filtering exemption requests helps you quickly locate requests based on specific criteria. To filter exemption requests, complete the following steps:

1. Navigate to the **Exemptions** page under the **Manage** section from the sidebar navigation of your SCS account.
2. Use the following options to filter and refine the list of exemption requests:
   * **Scope**: Filter and refine all exemption requests based on the scope at which they were created.
     * Click **Scope** and then select the checkboxes next to the desired scope to view the corresponding exemption requests.\
       The available options are **All**, **Target**, **Project**, **Organization**, and **Account**.
   * **Dependency**: Find specific exemption requests based on the dependency name and versions.
     * Click **Dependency** to specify the condition for the Dependency Name.
     * (Optional) Specify the condition for the Dependency Version. The available options are **All Versions** and **Specific Versions**.
   * **Reason**: Filter and refine all exemption requests based on the exemption reason.
     * Click **Reason** and then select the checkboxes next to the desired exemption reason to view the corresponding exemption requests.\
       The available options are **All**, **Acceptable use**, **Acceptable risk**, **No fix available**, and **Others**.

<figure><img src="https://234451070-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSN2B2M5cFWy0hhD0xTuE%2Fuploads%2FTPcbY53lee9RcuvXrd9I%2Ffilter-exemption-requests.png?alt=media&amp;token=f649540b-0a2e-44b5-85bf-29fef68bfb33" alt="Filter exemption requests"><figcaption><p>Filter exemption requests</p></figcaption></figure>

***

### Review an exemption request <a href="#review-an-exemption-request" id="review-an-exemption-request"></a>

Reviewing exemption requests helps ensure that only valid policy exceptions are granted. Users with the appropriate roles and resource group permissions can approve or reject exemption requests. You can access the **Exemptions** page at the **Account**, **Organization**, and **Project** scopes. Exemption requests can exist in one of the following states:

* [Pending](https://developer.harness.io/software-supply-chain-assurance/use-scs/open-source-management/manage-exemption-requests#pending) – Awaiting review and approval.
* [Approved](https://developer.harness.io/software-supply-chain-assurance/use-scs/open-source-management/manage-exemption-requests#approved) – Approved and currently active.
* [Rejected](https://developer.harness.io/software-supply-chain-assurance/use-scs/open-source-management/manage-exemption-requests#rejected) – Rejected by an approver.
* [Expired](https://developer.harness.io/software-supply-chain-assurance/use-scs/open-source-management/manage-exemption-requests#expired) – Approved previously but no longer active because the exemption has expired.

#### Pending <a href="#pending" id="pending"></a>

To review an exemption request in the pending state, complete the following steps:

1. Navigate to the **Exemptions** page under the **Manage** section from the sidebar navigation of your SCS account.\
   The **Pending** tab opens by default and displays exemption requests in a table. The table includes the dependency name, version, scope, reason, exemption duration, and requester.
2. Hover over the **Approve (thumbs up) icon** on the right side of the dependency row to display the available approval options.
   * Select **Approve for This Target** to approve the exemption only for the selected repository or artifact digest.
   * Select **Approve for This Project** to approve the exemption for all applicable targets within the current project.
   * Select **Approve for This Organization** to approve the exemption for all applicable projects and targets within the current organization.
   * Select **Approve for This Account** to approve the exemption across all applicable organizations, projects, and targets in the account.
3. Selecting any of the above options opens the **Approve Exemption for \<dependency\_name>** dialog, where you can review the exemption scope and the requested duration.
   * Specify the **Approval Duration** by selecting the preferred option from the dropdown list. The available options are **7 days**, **30 days**, **180 days**, and **All time**. The approval duration can match the requested exemption duration, or you can specify a different duration based on your organization's security and compliance requirements.
   * (Optional) Enter a detailed description to provide additional context for the selected approval duration.
   * Click **Approve** to approve the request.<br>

     <figure><img src="https://234451070-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSN2B2M5cFWy0hhD0xTuE%2Fuploads%2Fppdp8xRNHcmOmHTLQ9SE%2Fapprove-exemption-request.png?alt=media&amp;token=e1aa73a7-581b-4e06-a0f7-0dc465539061" alt="Approve a pending exemption request"><figcaption><p>Approve a pending exemption request</p></figcaption></figure>
4. Click the **Reject (thumbs down) icon** to open the **Reject Exemption for \<dependency\_name>** dialog, where you can review the exemption scope and provide a reason for rejecting the request.
   * In the **Comments** field, enter a detailed description explaining the reason for rejecting the exemption request.
   * Click **Reject** to reject the request.<br>

     <figure><img src="https://234451070-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSN2B2M5cFWy0hhD0xTuE%2Fuploads%2Feaqp8WdEkAIgvq3ndcan%2Freject-exemption-request.png?alt=media&amp;token=3c0bed79-4e4e-4c86-a3eb-5cf0a86d1310" alt="Reject a pending exemption request"><figcaption><p>Reject a pending exemption request</p></figcaption></figure>
5. Click the **Cancel (Cross) icon** to open the **Cancel Exemption Request** dialog.
   * Click **Cancel Exemption** to cancel the exemption request.

<figure><img src="https://234451070-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSN2B2M5cFWy0hhD0xTuE%2Fuploads%2FIXI1vYmGwsjpx8LvoeBV%2Fpending-exemption-requests.png?alt=media&amp;token=bf0ed5bb-1b89-471d-91ab-649749e5e686" alt="Pending exemption requests"><figcaption><p>Pending exemption requests</p></figcaption></figure>

#### Approved <a href="#approved" id="approved"></a>

To review an exemption request in the approved state, complete the following steps:

1. Navigate to the **Exemptions** page under the **Manage** section from the sidebar navigation of your SCS account.
2. Select the **Approved** tab to view approved exemption requests in a table. The table includes the dependency name, version, scope, reason, exemption duration, requester, and approver.
3. Click the **Reject (thumbs down) icon** on the right side of the dependency row to open the **Reject Exemption for \<dependency\_name>** dialog, where you can review the exemption scope and provide a reason for rejecting the request.
   * In the **Comments** field, enter a detailed description explaining the reason for rejecting the exemption request.
   * Click **Reject** to reject the request.
4. Click the **Cancel (Cross) icon** to open the **Cancel Exemption Request** dialog.
   * Click **Cancel Exemption** to cancel the exemption request.

<figure><img src="https://234451070-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSN2B2M5cFWy0hhD0xTuE%2Fuploads%2Fkd6T8eZb8qsk7wdmNRmL%2Fapproved-exemption-req-table.png?alt=media&amp;token=ab3c7bd2-18a4-4baf-8d45-7a51155f559f" alt="Approved exemption requests"><figcaption><p>Approved exemption requests</p></figcaption></figure>

#### Rejected <a href="#rejected" id="rejected"></a>

To review an exemption request in the rejected state, complete the following steps:

1. Navigate to the **Exemptions** page under the **Manage** section from the sidebar navigation of your SCS account.
2. Select the **Rejected** tab to view rejected exemption requests in a table. The table includes the dependency name, version, scope, reason, exemption duration, requester, and rejecter.
3. For exemption requests rejected at the **Target** or **Project** scope, you can cancel or reopen a rejected exemption request.
   * Click the **Cancel (Cross) icon** on the right side of the dependency row to open the **Cancel Exemption Request** dialog.
     * Click **Cancel Exemption** to cancel the exemption request.
   * Click the **Reopen (Anticlockwise open arrow) icon** to open the **Request Exemption for \<dependency\_name>** dialog.
     * Complete the required fields as described in [Create an exemption request](https://developer.harness.io/software-supply-chain-assurance/use-scs/open-source-management/manage-exemption-requests#create-an-exemption-request) to reopen the exemption request.
4. For exemption requests rejected at the **Organization** or **Account** scope, you can approve the request at the respective scope. Follow the steps in the [Pending](https://developer.harness.io/software-supply-chain-assurance/use-scs/open-source-management/manage-exemption-requests#pending) section to complete the approval.

<figure><img src="https://234451070-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSN2B2M5cFWy0hhD0xTuE%2Fuploads%2FuDaX73HdpM8EsB4cNFPd%2Frejected-exemption-req-table.png?alt=media&amp;token=c0fa1f8b-1975-47ca-b0b5-a6115fa29052" alt="Rejected exemption requests"><figcaption><p>Rejected exemption requests</p></figcaption></figure>

#### Expired <a href="#expired" id="expired"></a>

To review an exemption request in the expired state, complete the following steps:

1. Navigate to the **Exemptions** page under the **Manage** section from the sidebar navigation of your SCS account.
2. Select the **Expired** tab to view expired exemption requests in a table. The table includes the dependency name, version, scope, reason, exemption duration, and requester.
3. For exemption requests expired at the **Target** or **Project** scope, you can cancel or reopen a expired exemption request as described in the [Rejected](https://developer.harness.io/software-supply-chain-assurance/use-scs/open-source-management/manage-exemption-requests#rejected) section.
4. For exemption requests expired at the **Organization** or **Account** scope, you can approve the request at the respective scope as described in the [Rejected](https://developer.harness.io/software-supply-chain-assurance/use-scs/open-source-management/manage-exemption-requests#rejected) section.

<figure><img src="https://234451070-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSN2B2M5cFWy0hhD0xTuE%2Fuploads%2FnB7TQJ8hh7GTZvEHLgSC%2Fexpired-exemption-req-table.png?alt=media&amp;token=58dd90d1-1ff3-4266-800a-130fb64e13d8" alt="Expired exemption requests"><figcaption><p>Expired exemption requests</p></figcaption></figure>

### View an exempted dependency <a href="#view-an-exempted-dependency" id="view-an-exempted-dependency"></a>

Viewing an exempted dependency allows you to identify exempted dependencies from the SBOM list and filter them by their exemption status. To do this, complete the following steps:

1. Navigate to the **Code Repositories** or **Artifacts** page under the **Supply Chain** section from the sidebar navigation of your SCS account and select your repository or artifact (along with the digest). The `Overview` tab opens by default.
2. Select the `SBOM` tab to view the list of dependencies in the form of a table.
3. The **Exemption Status** column appears in the table with the current exemption status for each dependency. Each status is color-coded.
4. To narrow the list to a specific status, apply the **Exemption Status** filter. Go to [Repository Security Posture Management](https://developer.harness.io/software-supply-chain-assurance/use-scs/risk-and-compliance/repository-security-posture-management-rspm) to review the available SBOM filters.

<figure><img src="https://234451070-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSN2B2M5cFWy0hhD0xTuE%2Fuploads%2FC9rjfo9rNOpAtG5t0804%2Fview-exempted-dependency.png?alt=media&amp;token=bc79b086-59a6-468a-97f5-ca0be1dbfe03" alt="Exemption status in SBOM table"><figcaption><p>Exemption status in SBOM table</p></figcaption></figure>

### View exempted policy violated dependencies

Dependencies that violate an SBOM policy can have an exemption associated with them. You can view the exempted dependency from the policy-violated dependency list. Go to [Manage SBOM Policies](/software-supply-chain-assurance/use-scs/open-source-management/manage-sbom-policies.md) to learn more about SBOM policies.

To view exemptions for policy-violating dependencies:

1. Go to [View policy violations](https://developer.harness.io/software-supply-chain-assurance/use-scs/open-source-management/manage-sbom-policies#view-policy-violations) to view dependencies that violate an SBOM policy.
2. Locate the dependency with the exemption icon next to its name.\
   Hover over the icon to display the `Exempted` tooltip.
3. Select the **Exclude Exempted Dependencies** checkbox at the top right of the side panel to exclude exempted dependencies from the policy violations table.

<figure><img src="https://234451070-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSN2B2M5cFWy0hhD0xTuE%2Fuploads%2FM8avBBWm9oNQC6tGJMYf%2Fview-exempted-policy-violated-dependencies.png?alt=media&amp;token=d1dae98d-a955-4fa5-a3d6-fb82bec003ad" alt="View exempted policy violated dependencies"><figcaption><p>Exempted policy violated dependencies</p></figcaption></figure>

### Exemptions permission matrix <a href="#next-steps" id="next-steps"></a>

The exemptions permission matrix outlines the permissions required for actions such as creating, viewing, approving, rejecting, canceling, and reopening exemption requests. It helps you understand which permissions are required at the project, organization, and account scopes for each action. The following table outlines the required permissions for each action at the project, organization, and account scopes.

| Action                               | Permission                      | Project | Org | Account | Notes                                                                                                                                                                                                                                                                                        |
| ------------------------------------ | ------------------------------- | ------- | --- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Create an Exemption Request          | **Create**                      | ✅       | ❌   | ❌       | Exemption requests can only be created at the project scope.                                                                                                                                                                                                                                 |
| View Exemptions Requests             | **View**                        | ✅       | ❌   | ❌       | Viewing exemption requests is based entirely on project-level **View** permissions. Organization- and account-level **View** permissions are not required.                                                                                                                                   |
| Approve or Reject Exemption Requests | **View** and **Approve/Reject** | ✅       | ❌   | ❌       | Required to access exemption requests at the project level.                                                                                                                                                                                                                                  |
| Approve or Reject Exemption Requests | **Approve/Reject**              | ✅       | ✅   | ✅       | Can approve or reject exemption requests at the requested scope or a higher scope (organization or account). The exemption applies to all organizations and projects within the approved scope, including those that the reviewer cannot access.                                             |
| Re-open an Exemption Request         | **View** and **Create**         | ✅       | ❌   | ❌       | Reopening an exemption request is only allowed for the Project or Target scopes. Exemption requests approved at the Organization or Account scope cannot be reopened after they are rejected or expire. Instead, they can only be approved again directly from the corresponding status tab. |

For more information about applying permissions for SBOM dependency exemptions, go to [Manage SCS Access Control with RBAC](https://developer.harness.io/software-supply-chain-assurance/troubleshooting-and-resources/settings-1/rbac#supported-scs-resources-and-permissions).

### Next steps <a href="#next-steps" id="next-steps"></a>

* [OSS Risks Remediation](https://developer.harness.io/software-supply-chain-assurance/use-scs/open-source-management/oss-risks-remediation): Remediate detected open-source software (OSS) risks across your repositories and artifacts to strengthen your software supply chain security.
* [Generate AIBOM for Repositories](https://developer.harness.io/software-supply-chain-assurance/use-scs/open-source-management/generate-aibom-for-repositories): Generate AI Bill of Materials (AIBOMs) to identify and inventory AI components used across your source code repositories.