{"id":"sec-it-risk-exception-form","audience":"it-security","category":"security","track":"security","technique":"constraints","title":"Fill a risk exception form within policy limits","free":false,"task":"A team asked for a security exception. Fill the exception form in exactly 5 numbered lines labeled Risk, Compensating controls, Owner, Expires, Decision needed. Policy caps exceptions at 90 days from approval, so use a 90-day expiry even though the team asked for longer. Use only facts from the request. Plain text, under 110 words.","materialLabel":"Exception request and policy note (attached to your prompt automatically)","material":"Exception request EX-31 (submitted Nov 3, 2026, by Priyanka Shah, Lab Systems manager)\n\n\"We need an exception to the patching policy for LAB-PC-07, which runs the MassSpec 4 lab instrument software. The instrument vendor only supports Windows 10 on this PC, and Windows 10 no longer gets security updates. Replacing the instrument costs $180,000 and is planned for next fiscal year. Please approve the exception for 1 year.\n\nWhat we already did: the PC is on its own network segment and can't reach the internet. Only 3 lab techs can sign in. USB ports are disabled except for the instrument cable. We take a full backup weekly.\"\n\nPolicy note: exceptions are approved by the CISO for at most 90 days, then must be renewed. Approval meeting: Nov 13, 2026 (90 days later is Feb 11, 2027).\n\nAnalyst comment (Raj): \"honestly I'd just approve it, the lab is careful.\"","rules":[{"type":"numberedItems","count":5},{"type":"plainText"},{"type":"maxWords","max":110}],"mistakes":[{"title":"Granting what was asked","why":"The AI copies the 1-year request into the form.","fix":"Say: \"Policy caps exceptions at 90 days: Expires Feb 11, 2027.\"","checks":["r1"]},{"title":"Dropping controls","why":"The AI summarizes 'some controls are in place' instead of listing them.","fix":"Ask: \"List each compensating control from the request.\"","checks":["r2"]},{"title":"Adding opinions","why":"The AI includes Raj's 'just approve it' as a recommendation.","fix":"Add: \"Use only facts from the request.\"","checks":["r2"]},{"title":"No form shape","why":"The AI writes a memo.","fix":"Give the fields: \"Exactly 5 numbered lines: Risk, Compensating controls, Owner, Expires, Decision needed.\"","checks":["r0","numberedItems"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 110 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 85 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the form they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Gives the form fields","patterns":["compensating","expires","decision needed","owner"]},{"label":"Applies the 90-day cap","patterns":["90","feb(ruary)? 11","cap","policy"]},{"label":"Says exactly how many","patterns":["\\b5\\b.{0,25}(line|field|item)","exactly (5|five)"]},{"label":"Keeps it to the material","patterns":["only (use )?(the )?(facts|what|info|details)","don'?t (invent|make up|guess|add)","not in the","stick to","nothing (else|extra|outside)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"A form should reflect policy, not just the request. Give the AI the fields, the 90-day cap and its exact date, and keep opinions out.","rubricLabels":["The 5 lines are labeled Risk, Compensating controls, Owner, Expires, Decision needed, in that order","Expires is Feb 11, 2027 (90 days), not 1 year","Risk mentions LAB-PC-07 running unsupported Windows 10 with no security updates, Compensating controls lists the separate network segment with no internet, 3 users, disabled USB and weekly backup, and Owner is Priyanka Shah"]}