# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-AGE-003
title: Grant release-age exceptions explicitly and for a limited time
finding:
  title: The release-age rule is bypassed without trace or without end date
status: draft
profiles: [baseline]
risk:
  severity: low
assessment: manual
tags: [release-age, exception]
description: |
  When a version younger than the release-age threshold is needed (typically an urgent security fix), the exception names the package and exact version, the reason, the approver, and expires after at most {{ max_exception_days }} days.
rationale: |
  Without a clear process, teams disable the rule globally the first time they are blocked, and never turn it back on.
impact: |
  Someone must be available to approve exceptions quickly.
parameters:
  - name: max_exception_days
    type: integer
    description: Maximum lifetime of a release-age exception.
    unit: days
    default: 7
    minimum: 1
    maximum: 30
audit:
  manual: |
    1. List active release-age exceptions.
    2. Check each one targets an exact version, has a recorded reason and approver, and is younger than {{ max_exception_days }} days.
    3. Check the global rule is not disabled.
  checks:
    - id: postmortem
      engine: postmortem
      description: "every [[gate.allow]] / AGE waiver has an expiry within the limit; approval is by hand"
      spec:
        command: postmortem harden --json
        control: CB-DEP-AGE-003
        coverage: partial
remediation:
  manual: |
    1. Define who can approve exceptions and where they are recorded.
    2. Remove expired and global exceptions.
references:
  - title: Secure Supply Chain Consumption Framework (S2C2F)
    url: https://github.com/ossf/s2c2f
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: CM-3
    relation: related
related_controls:
  - id: CB-DEP-AGE-001
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16