Manage Exemption Requests

Create, review, and track SBOM dependency exemption requests in Supply Chain Security.

Supply Chain Security (SCS) helps you identify software components or dependencies that violate your organization's security, compliance, and licensing policies. However, there are situations where a blocked dependency may still need to be used temporarily. For example, no fixed version may be available, or the risk may have been assessed and accepted. Without an exemption workflow, organizations must either enforce policies and block development or relax the policies entirely. This increases security and compliance risks.

SBOM dependency exemptions provide a controlled way to make policy exceptions for specific software components or dependencies. Instead of modifying the underlying SBOM policy, exemptions apply only to the selected dependency. This enables organizations to accommodate approved exceptions while maintaining governance and compliance. Developers can request exemptions, and security approvers can review and manage them through a centralized approval workflow.

---

What will you learn in this topic?

By the end of this topic, you will be able to:

• Understand SBOM dependency exemptions and how they work.

• Create and manage dependency exemption requests for SBOM policy violations.

• Review exemption requests across the Pending, Approved, Rejected, and Expired states.

• Filter exemption requests and identify exempted dependencies in the SBOM.

---

Before you begin

Make a note of the following before you proceed with managing exemption requests in SCS:

• Make sure that your source code management (SCM) provider is integrated with the platform to generate SBOMs for your code repositories. You can do this in one of the following ways:

  • Repository onboarding through RSPM currently supports GitHub and Bitbucket:

    • To integrate your GitHub account and onboard the repositories, go to Onboard GitHub Repositories.

    • To integrate your Bitbucket account and onboard the repositories, go to Onboard Bitbucket Repositories.

  • SBOMs can be generated through pipeline execution. To generate SBOM via pipeline execution, refer to the Generate SBOM for Repositories documentation.

• Make sure that SBOMs are generated for your container artifacts. For more information, go to Generate SBOM for Artifacts.

• Make sure you have the appropriate roles and resource group permissions to view, create, approve, or reject an exemption request. For more information, go to Supported SCS Resources and Permissions.

---

Understand SBOM dependency exemptions

An SBOM dependency exemption is a policy exception that allows a specific software component or dependency to bypass SBOM policy enforcement under defined conditions. Unlike modifying an SBOM policy, an exemption affects only the selected dependency and does not change how the policy is enforced for other dependencies. This allows organizations to address exceptions without reducing the effectiveness of their security and compliance policies.

Every exemption is defined by a set of attributes that determine how it is evaluated. These attributes include the exemption scope, version scope, duration, reason, and an optional justification. Together, they define where the exemption applies, which dependency versions it covers, how long it remains active, and the business or security context behind the exception.

Exemptions support multiple hierarchy levels, including the target, project, organization, and account scopes. They can also be configured to apply to a specific dependency version or to all versions of the dependency. All exemption activities are retained in the audit history, helping organizations maintain visibility, governance, and compliance across policy exceptions.

Why use it?	When to use it?	How can you leverage it?
Limit the impact of policy exceptions. Control where an exemption applies. Control which dependency versions are exempted. Ensure policy exceptions remain governed and auditable.	When only a specific dependency requires an exception. When an exception should be limited to a target, project, organization, or account. When an exemption should apply to a single version or every version of a dependency. When exceptions require periodic review or compliance tracking.	Create an exemption for the affected dependency instead of modifying the policy. Configure the exemption scope based on organizational requirements. Configure the version scope to exempt either the selected dependency version or all versions of the dependency. Configure the exemption duration and retain approval records for auditing.

---

SBOM dependency exemptions workflow

When a component or dependency violates an SBOM policy, developers can request an exemption directly from the dependency details in the SBOM. After the request is submitted, it enters the Pending state until a security approver reviews it. During the review process, the approver can approve or reject the request. If required, the approver can approve the exemption at a higher scope than originally requested. For example, a request submitted at the target scope can be approved at the project, organization, or account scope.

During policy evaluation, Harness checks for an active exemption before enforcing an SBOM policy. If a matching exemption exists and its scope and duration are valid, the policy violation is exempted. Otherwise, the policy is enforced as configured.

When an exemption expires, it is no longer considered during policy evaluation. If the dependency still violates a policy, a new exemption request must be submitted. If a dependency is already covered by an active exemption, the SBOM displays the exemption status and prevents duplicate exemption requests. Users can also view details such as the approver, justification, scope, and expiration date for the existing exemption.

---

Create an exemption request

Creating an exemption request for a dependency allows you to continue using a software component or dependency while it undergoes review. To request an exemption, complete the following steps:

1. Navigate to the Code Repositories or Artifacts page under the Supply Chain section from the sidebar navigation of your SCS account and select your repository or artifact (along with the digest). The Overview tab opens by default.

2. Select the SBOM tab to view the list of dependencies in the form of a table.

3. Select the dependency for which you want to request an exemption to open the side panel.

4. Click the Request Exemption button on the top right of the side panel to open the Request Exemption for <dependency_name> dialog.

5. Select the appropriate radio button to specify the exemption scope for the dependency.

   • Choose This Target to apply the exemption only to the current target.

   • Choose This Project to apply the exemption across the project.

6. Select the appropriate radio button to specify the dependency version to exempt.

   • Choose This Version (version_number) to apply the exemption only to the selected version of the dependency.

   • Choose All Versions to apply the exemption to all versions of the dependency.

7. Specify the exemption duration by selecting the preferred option from the dropdown list. The available options are 7 days, 30 days, 180 days, and All time.

8. Select the appropriate exemption reason from the dropdown list. The available options are Acceptable use, Acceptable risk, No fix available, and Others.

9. (Optional) Enter a detailed description to provide additional context for the selected exemption reason.

10. (Optional) Enter any URL that provides additional context or supporting information for the exemption request.

11. Click Create Request to create the exemption request.

Raising an exemption request for a target is only supported for artifacts and does not apply to repositories.

Create exemption requests

Filter exemption requests

Filtering exemption requests helps you quickly locate requests based on specific criteria. To filter exemption requests, complete the following steps:

1. Navigate to the Exemptions page under the Manage section from the sidebar navigation of your SCS account.

2. Use the following options to filter and refine the list of exemption requests:

   • Scope: Filter and refine all exemption requests based on the scope at which they were created.

     • Click Scope and then select the checkboxes next to the desired scope to view the corresponding exemption requests. The available options are All, Target, Project, Organization, and Account.

   • Dependency: Find specific exemption requests based on the dependency name and versions.

     • Click Dependency to specify the condition for the Dependency Name.

     • (Optional) Specify the condition for the Dependency Version. The available options are All Versions and Specific Versions.

   • Reason: Filter and refine all exemption requests based on the exemption reason.

     • Click Reason and then select the checkboxes next to the desired exemption reason to view the corresponding exemption requests. The available options are All, Acceptable use, Acceptable risk, No fix available, and Others.

Filter exemption requests

---

Review an exemption request

Reviewing exemption requests helps ensure that only valid policy exceptions are granted. Users with the appropriate roles and resource group permissions can approve or reject exemption requests. You can access the Exemptions page at the Account, Organization, and Project scopes. Exemption requests can exist in one of the following states:

• Pending – Awaiting review and approval.

• Approved – Approved and currently active.

• Rejected – Rejected by an approver.

• Expired – Approved previously but no longer active because the exemption has expired.

Pending

To review an exemption request in the pending state, complete the following steps:

1. Navigate to the Exemptions page under the Manage section from the sidebar navigation of your SCS account. The Pending tab opens by default and displays exemption requests in a table. The table includes the dependency name, version, scope, reason, exemption duration, and requester.

2. Hover over the Approve (thumbs up) icon on the right side of the dependency row to display the available approval options.

   • Select Approve for This Target to approve the exemption only for the selected repository or artifact digest.

   • Select Approve for This Project to approve the exemption for all applicable targets within the current project.

   • Select Approve for This Organization to approve the exemption for all applicable projects and targets within the current organization.

   • Select Approve for This Account to approve the exemption across all applicable organizations, projects, and targets in the account.

3. Selecting any of the above options opens the Approve Exemption for <dependency_name> dialog, where you can review the exemption scope and the requested duration.

   • Specify the Approval Duration by selecting the preferred option from the dropdown list. The available options are 7 days, 30 days, 180 days, and All time. The approval duration can match the requested exemption duration, or you can specify a different duration based on your organization's security and compliance requirements.

   • (Optional) Enter a detailed description to provide additional context for the selected approval duration.

   • Click Approve to approve the request.

     

     Approve a pending exemption request
4. Click the Reject (thumbs down) icon to open the Reject Exemption for <dependency_name> dialog, where you can review the exemption scope and provide a reason for rejecting the request.

   • In the Comments field, enter a detailed description explaining the reason for rejecting the exemption request.

   • Click Reject to reject the request.

     

     Reject a pending exemption request
5. Click the Cancel (Cross) icon to open the Cancel Exemption Request dialog.

   • Click Cancel Exemption to cancel the exemption request.

Pending exemption requests

Approved

To review an exemption request in the approved state, complete the following steps:

1. Navigate to the Exemptions page under the Manage section from the sidebar navigation of your SCS account.

2. Select the Approved tab to view approved exemption requests in a table. The table includes the dependency name, version, scope, reason, exemption duration, requester, and approver.

3. Click the Reject (thumbs down) icon on the right side of the dependency row to open the Reject Exemption for <dependency_name> dialog, where you can review the exemption scope and provide a reason for rejecting the request.

   • In the Comments field, enter a detailed description explaining the reason for rejecting the exemption request.

   • Click Reject to reject the request.

4. Click the Cancel (Cross) icon to open the Cancel Exemption Request dialog.

   • Click Cancel Exemption to cancel the exemption request.

Approved exemption requests

Rejected

To review an exemption request in the rejected state, complete the following steps:

1. Navigate to the Exemptions page under the Manage section from the sidebar navigation of your SCS account.

2. Select the Rejected tab to view rejected exemption requests in a table. The table includes the dependency name, version, scope, reason, exemption duration, requester, and rejecter.

3. For exemption requests rejected at the Target or Project scope, you can cancel or reopen a rejected exemption request.

   • Click the Cancel (Cross) icon on the right side of the dependency row to open the Cancel Exemption Request dialog.

     • Click Cancel Exemption to cancel the exemption request.

   • Click the Reopen (Anticlockwise open arrow) icon to open the Request Exemption for <dependency_name> dialog.

     • Complete the required fields as described in Create an exemption request to reopen the exemption request.

4. For exemption requests rejected at the Organization or Account scope, you can approve the request at the respective scope. Follow the steps in the Pending section to complete the approval.

Rejected exemption requests

Expired

To review an exemption request in the expired state, complete the following steps:

1. Navigate to the Exemptions page under the Manage section from the sidebar navigation of your SCS account.

2. Select the Expired tab to view expired exemption requests in a table. The table includes the dependency name, version, scope, reason, exemption duration, and requester.

3. For exemption requests expired at the Target or Project scope, you can cancel or reopen a expired exemption request as described in the Rejected section.

4. For exemption requests expired at the Organization or Account scope, you can approve the request at the respective scope as described in the Rejected section.

Expired exemption requests

View an exempted dependency

Viewing an exempted dependency allows you to identify exempted dependencies from the SBOM list and filter them by their exemption status. To do this, complete the following steps:

1. Navigate to the Code Repositories or Artifacts page under the Supply Chain section from the sidebar navigation of your SCS account and select your repository or artifact (along with the digest). The Overview tab opens by default.

2. Select the SBOM tab to view the list of dependencies in the form of a table.

3. The Exemption Status column appears in the table with the current exemption status for each dependency. Each status is color-coded.

4. To narrow the list to a specific status, apply the Exemption Status filter. Go to Repository Security Posture Management to review the available SBOM filters.

Exemption status in SBOM table

View exempted policy violated dependencies

Dependencies that violate an SBOM policy can have an exemption associated with them. You can view the exempted dependency from the policy-violated dependency list. Go to Manage SBOM Policies to learn more about SBOM policies.

To view exemptions for policy-violating dependencies:

1. Go to View policy violations to view dependencies that violate an SBOM policy.

2. Locate the dependency with the exemption icon next to its name. Hover over the icon to display the Exempted tooltip.

3. Select the Exclude Exempted Dependencies checkbox at the top right of the side panel to exclude exempted dependencies from the policy violations table.

Exempted policy violated dependencies

Exemptions permission matrix

The exemptions permission matrix outlines the permissions required for actions such as creating, viewing, approving, rejecting, canceling, and reopening exemption requests. It helps you understand which permissions are required at the project, organization, and account scopes for each action. The following table outlines the required permissions for each action at the project, organization, and account scopes.

Action	Permission	Project	Org	Account	Notes
Create an Exemption Request	Create	✅	❌	❌	Exemption requests can only be created at the project scope.
View Exemptions Requests	View	✅	❌	❌	Viewing exemption requests is based entirely on project-level View permissions. Organization- and account-level View permissions are not required.
Approve or Reject Exemption Requests	View and Approve/Reject	✅	❌	❌	Required to access exemption requests at the project level.
Approve or Reject Exemption Requests	Approve/Reject	✅	✅	✅	Can approve or reject exemption requests at the requested scope or a higher scope (organization or account). The exemption applies to all organizations and projects within the approved scope, including those that the reviewer cannot access.
Re-open an Exemption Request	View and Create	✅	❌	❌	Reopening an exemption request is only allowed for the Project or Target scopes. Exemption requests approved at the Organization or Account scope cannot be reopened after they are rejected or expire. Instead, they can only be approved again directly from the corresponding status tab.

For more information about applying permissions for SBOM dependency exemptions, go to Manage SCS Access Control with RBAC.

Next steps

• OSS Risks Remediation: Remediate detected open-source software (OSS) risks across your repositories and artifacts to strengthen your software supply chain security.

• Generate AIBOM for Repositories: Generate AI Bill of Materials (AIBOMs) to identify and inventory AI components used across your source code repositories.