Waivers, staleness, and revocation

A waiver targets one profile requirement and records its owner, reason, compensating control, evidence, approver, and expiry. Agents cannot request or approve waivers.

Non-waivable controls

Tenant isolation, authenticated identity, required separation of duties, inventory, functional parity, cutover readiness, and an uncertain non-idempotent cutover outcome do not become acceptable through a waiver. Policy may make additional tracks non-waivable by object class or environment.

Staleness

A certificate becomes stale or revoked when policy-defined material changes: artifact or deployment digest, source watermark, target snapshot, profile/policy revision, dependency readiness, evidence validity, tool generation, waiver expiry, deployment drift, or a critical observation breach.

Historical certificates stay immutable and inspectable. A stale or revoked certificate cannot satisfy the cutover gate; the object returns to a state where new evidence can be admitted and a new certificate minted.