A SaaS or AI security exception should name the affected use, unmet requirement, accepting owner, temporary safeguards, expiry date and exit criteria. Link the exception to evidence and implementation tasks.