# Product security operating plan and exception register

Completed example — all product names, people, evidence IDs and results below are synthetic teaching data. They are not test results from this website or an assessment of a real product.

## Inventory and ownership

| Product | Engineering owner | Security contact | Risk basis | Release path | Baseline |
| --- | --- | --- | --- | --- | --- |
| LedgerDesk invoice API | Mira | Noor | Tenant financial records | Reviewed CI→signed artifact→staging→production | Boundary review, candidate tests, dependency response |
| Public documentation | Jules | Noor | Public static content | Static build and private preview | Dependency checks, link/a11y checks, publishing owner |

## Operating plan

New identity, export or storage audience changes trigger a design record owned by the feature team. Every invoice release requires artifact-bound object/field/tenant tests and a running-digest observation. Dependency advisories require a deployed-component/configuration join, an accountable decision and a due date. Evidence stays with the release record and retains failed cases as well as passes.

## Exception register

| ID | Scope and risk | Compensating control | Accepter | Expiry | Repair / verification | Expiry action |
| --- | --- | --- | --- | --- | --- | --- |
| X-12 | r43 bulk export disabled while execution-time authorization is repaired | Disablement verified through API, worker and download routes in run43-disable | Mira, product owner | Exercise date + 7 days | Ravi repairs; Noor retests revoked actor plus positive owner | Keep feature disabled; escalate missed deadline |

X-12 does not pass the missing export control and cannot authorize future releases automatically. No exception permits active cross-tenant disclosure under this product policy.

## Measures

Inventory denominator is two owned products, one high-risk API. Track 1/1 high-risk products with release evidence, median and maximum critical exposure days for confirmed findings, repeat authorization defects and exceptions beyond expiry. Report unobserved deployment identity as unknown, not compliant. At the next monthly review, inspect whether the new worker-revocation regression prevented recurrence; a count of completed training sessions is not the success measure.