Exception requests details | AI Agent Security

The Exception requests list tells you a request exists and where it stands. The details panel is where you decide it: it shows who asked, what was blocked, which policies blocked it, and why the requester needs it, and it holds the controls to approve, deny, or revoke.

Scope of this guide

This guide explains the exception request details panel: the Overview and Timeline tabs, and how to approve, deny, revoke, or withdraw a request. It does not cover writing the policy that produced the block.

Prerequisites

• You have administrator access to the tenant.
• At least one request appears on the Exception requests page.

Open the details panel

1. Go to Protection > Exception Requests.
2. Select the request you want to review.

The panel opens on the Overview tab. To open the request on a page of its own, select the expand icon in the top right corner. To close the panel, select the X beside it.

Selecting Approve or Deny in a list row also opens this panel, with that decision ready to complete.

Tabs

Overview tab

The top of the tab gathers the context of the block.

Below the fields, the panel shows the call that was blocked, the policies it matched, and the requester's justification. Once a request is approved, the panel also shows the grant: how long it has left and any note the approver left.

Read the justification against the blocked call rather than on its own. The justification explains why the requester wants the action; the blocked call is what they would be granted, and the two are not always the same size.

Decide a pending request

The footer of a pending request holds Deny and Approve.

Approve a request

1. Select Approve.
2. Read the note at the top of the composer. It names the policy that approving relaxes and the endpoint it applies to.
3. Under Grant window, keep the duration the requester asked for, or choose another, such as 4h. You can also enter a custom duration.
4. Optionally, enter an Approval note. It goes to the audit trail.
5. Select the approve button, which names the window, such as Approve for 4h.

To back out, select the cancel control beside the note at the top of the composer.

Approving relaxes the matching policy in full on that endpoint for the grant window, not only the one call that was blocked. The approval reaches the endpoint in 15 to 30 seconds, and the policy shows as Exception on that endpoint until the window ends. Where the same call is requested again and again, changing the policy is usually a better fix than approving each exception.

Deny a request

1. Select Deny.
2. Enter a Denial reason. A reason is required, and it is the only thing the requester sees, so say what to do instead.
3. Select Deny again to confirm.

Denying closes the request and leaves the block in place. The requester can submit a new request with a revised scope.

Revoke an approved request

An approved request shows Revoke grant in the footer while its window is still running.

1. Open the approved request.
2. Select Revoke grant.

Revoking reaches the endpoint in around 15 seconds, and the policy's normal posture returns there. When the window has already run out, there is nothing left to revoke and the footer says so.

A self-approved request cannot be revoked from this panel. Its grant is held on the endpoint, so the footer offers View on endpoint instead.

What a requester sees

A user without administrator access who opens their own request does not see Approve or Deny. While the request is pending, the footer says it is waiting on a reviewer and that nothing is relaxed on their machine until someone approves it, and offers Withdraw to cancel the request. A withdrawn request is recorded with the status Cancelled.

How a decision is recorded

When you approve or deny, the request leaves the Pending tab and moves to Approved or Denied. The Decision column on the list shows the outcome with who decided and when, the decision appears on the Timeline tab, and it counts toward the Approved today or Denied today card on the Exception requests page.

Verify the results

After you decide, confirm the request has left the Pending tab and appears under Approved or Denied with the outcome you intended, and that the Timeline tab records your decision. After revoking, confirm the Decision column reads Revoked.

Next steps

• Return to the Pending tab to work the next request.
• For a call that generates frequent exceptions, open the policy that blocked it and decide whether the policy needs to change.
• Check the Self-approved tab for exceptions users granted themselves.