# Waivers

> Recording accepted exceptions, and what expiration means.

Source: https://refpoint.dev/docs/rules/waivers

A waiver is an accepted-risk audit record, not a way to silence noise. This page
covers writing waivers and what expiration means. Narrowing a run to selected
controls is on the [Filters](/docs/rules/filters) page.

## Writing a waiver file

```hcl
waiver "ssh-05" {
  justification = "Legacy appliance, replacement scheduled Q3. Risk accepted by S. Okafor."
  expiration    = "2026-09-30"
  run           = false
}

waiver "audit-12" {
  justification = "Compensating control in place; still monitored."
  expiration    = "2026-12-31"
  run           = true
}
```

Apply it with `--waiver-file PATH`.

| Attribute | Type | Notes |
|---|---|---|
| label | string | The control ID |
| `justification` | string, required | Must not be empty or whitespace |
| `expiration` | string | `YYYY-MM-DD`. Absent means never expires |
| `run` | bool | Default true |

An empty justification defeats the purpose of the record, so it is rejected at
load time even though HCL's own required-attribute handling would permit `""`.

## run = false against run = true

With `run = false` the control is not executed at all and its status is
`waived`. `only_if` is not evaluated either.

With `run = true` the control executes normally and the results are recorded,
but the status is overridden to `waived`. Use this to keep evidence flowing for
a control you have chosen not to gate on.

Waived controls are excluded from the weighted score denominator, since they are
accepted exceptions rather than collected evidence.

## Expiration semantics

A date-only expiration means valid through the end of that day. The parsed date
is extended to the last instant of that day in UTC, so a waiver is not treated
as expired for essentially all of its stated final day.

Loading a waiver file prints a warning to stderr for any waiver that has already
expired, naming the control and the date.

An expired waiver does not change the outcome, but it rides along on the result
with `expired: true`. Without that, a control that flips to failed the day after
its waiver lapses is indistinguishable from a brand new failure. The TUI's `w`
filter surfaces waived controls and lapsed-waiver annotations together.