Waivers

A waiver is an accepted-risk audit record, not a way to silence noise. This page covers writing waivers and what expiration means. Narrowing a run to selected controls is on the Filters page.

Writing a waiver file

waiver "ssh-05" {
  justification = "Legacy appliance, replacement scheduled Q3. Risk accepted by S. Okafor."
  expiration    = "2026-09-30"
  run           = false
}

waiver "audit-12" {
  justification = "Compensating control in place; still monitored."
  expiration    = "2026-12-31"
  run           = true
}

Apply it with --waiver-file PATH.

An empty justification defeats the purpose of the record, so it is rejected at load time even though HCL’s own required-attribute handling would permit "".

run = false against run = true

With run = false the control is not executed at all and its status is waived. only_if is not evaluated either.

With run = true the control executes normally and the results are recorded, but the status is overridden to waived. Use this to keep evidence flowing for a control you have chosen not to gate on.

Waived controls are excluded from the weighted score denominator, since they are accepted exceptions rather than collected evidence.

Expiration semantics

A date-only expiration means valid through the end of that day. The parsed date is extended to the last instant of that day in UTC, so a waiver is not treated as expired for essentially all of its stated final day.

Loading a waiver file prints a warning to stderr for any waiver that has already expired, naming the control and the date.

An expired waiver does not change the outcome, but it rides along on the result with expired: true. Without that, a control that flips to failed the day after its waiver lapses is indistinguishable from a brand new failure. The TUI’s w filter surfaces waived controls and lapsed-waiver annotations together.