A business exception is a policy waiver or carve-out that allows a team, system, or user to bypass standard security controls for a limited purpose. In security programs, exceptions are used to keep critical operations running when a control is too disruptive, a legacy system cannot yet be fixed, or a business need outweighs the immediate risk.
Business exceptions matter because they create temporary trust paths in systems that are designed to minimize trust. If exceptions are broad, poorly documented, or never retired, they can become permanent weak points. Attackers often look for these gaps, such as old access rules, privileged accounts kept alive for convenience, or monitoring that was relaxed for a special case. Defenders reduce risk by requiring approval, expiration dates, compensating controls, and regular review so the carve-out does not become a hidden back door.