Background

As part of the rollout of PR gating and stage gating, exemptions are being used to provide developers with a defined period to remediate security findings when immediate fixes are not feasible. Effective communication and visibility of exemption status are critical to ensuring timely remediation and preventing unexpected deployment failures once exemptions expire.

Current Gap

Currently, there is no automated notification mechanism to inform stakeholders when:

A new exemption is approved.

An exemption is approaching its expiry date.

An exemption has expired.

An exemption request is approved or rejected.