AI Incident Response: How GCCs Should Handle Production Failures
This article examines the control debt created when Azure Policy exemptions outlive the delivery pressure that first justified them. It argues that an exemption is a legitimate governance tool only when the enterprise can explain the business reason, accountable owner, scope, expiry, compensating control, review trigger, and removal route.