What to Do When the Review Finds a Risk You Cannot Fix

The most common failure in acceptance records is restating the control requirement instead of describing what the environment cannot do. "Prompt injection filtering is not comprehensive" tells the signer nothing they can verify.

A usable gap statement carries observable consequences and numbers:

The launch configuration has no deterministic check between the agent's tool output and the payment service. In the last 30 days the agent issued a median of 412 tool calls per day, of which 3 to 6 involved a state change. If a manipulated document in the retrieval store causes one state-change call to carry an attacker-chosen recipient, the payment service executes it under the service account and no approval step catches it.

That gives the signer four questions they can ask: how many calls, which tools change state, what account those tools use, and where the missing check would sit. If your gap statement cannot survive those questions, rewrite it.

Obligation mapping matters more than teams expect because it changes the kind of risk being accepted. A signer who learns at audit that an accepted gap was also a reportable control failure was not given the record they needed per this acceptance guidance. If the gap maps to a named framework entry, say so. The OWASP Top 10 for LLM Applications is common, and both the 2025 and 2026 numberings circulate, so cite the edition you tested against per this summary.

The rule is simple and often violated: the signer is not the person who built the system. They are the person whose budget, regulatory posture, or business continuity absorbs the failure. For an AI feature touching customer data that is usually the product owner's manager or the business unit lead, with security and privacy as reviewers rather than approvers of the final call.

A multi-party check is worth borrowing from vendor acceptance memos, which route the decision past business, security, privacy and legal, procurement, service owner, risk owner, and the final authority as applicable per this memo template. You do not need seven signatures for an internal launch, but you need the ones that map to real exposure: whoever owns the data, whoever answers the incident, and whoever can stop the launch.

Two governance rules keep this from decaying:

• Every acceptance has an expiry date, and renewals require fresh evidence that the blocker still exists.
• Repeated requests from the same service are escalated, and leadership sees exception age and concentration, not just total count per this handbook.

The decay pattern is predictable. The first exception is scrutinized, the second is routine, and the third is a spreadsheet line nobody reads. Age and concentration reporting is what makes the third visible.

A compensating control is an alternative safeguard that meets the same objective as the primary control when that control cannot be implemented, and it is typically temporary and specific to the deficiency per MetricStream's guide. That definition carries an obligation: the record must say when the control ends and what it covers.

The biggest mistake is listing controls without tested status. "Network access logging is enabled and reviewed" tells the signer coverage exists, not that it works. Each entry needs the control name and owner, the most recent test result and date, the period covered, and a plain statement of what the control actually reduces per this acceptance guidance.

For AI systems the highest-value compensating controls usually reduce agency rather than add detection. OWASP describes excessive agency as built from excessive functionality, excessive permissions, and excessive autonomy, any of which can be trimmed before launch, and recommends requiring approval for high-impact actions per the LLM06 entry. A tool that can read and delete documents but only needs to read is a one-line change, and it is the cheapest fix you have.

Practical controls for a gap you cannot close:

• Reduce the tool surface. Remove tools the launch does not need and run remaining tools in the user's context rather than a shared high-privilege identity per the LLM06 entry.
• Put the check in code, not the prompt. Enforce authorization outside the model, validate responses deterministically, and require human confirmation for irreversible actions per the 2026 risk table.
• Narrow the deployment scope. Cap blast radius with rate limits and hard spending ceilings, which OWASP lists among the mitigations for unbounded consumption per the LLM10 entry.
• Partition retrieval. If the gap lives in RAG, enforce permission-aware vector stores and strict logical partitioning so one tenant's query cannot retrieve another's embeddings per the LLM08 entry.

Write the residual limitation next to each control. The record should not claim the controls are equivalent to the missing one; it should say why the residual exposure is temporarily inside the authorized boundary per this template.

Monitoring answers one question: are the compensating controls still doing what the record claims? That means metrics come from the controls, not from generic system health.

Thresholds belong in the record so the signer knows what pulls them back in.

OWASP names rate limiting, input size checks, hard spending caps, and circuit breakers for agents as the mitigations for runaway consumption, and denial of wallet is explicitly about cost-per-use services being drained by volume per the LLM10 entry. If your gap is in cost control, those four are your compensating controls and the spend metric is your proof.

Logging needs the same treatment. Vector and embedding weaknesses are mitigated in part by monitoring ingest and retrieval, because poisoning and unusual retrieval patterns show up in those records before they show in outcomes per this RAG security explainer. Keep the logs queryable for the life of the exception, because they are evidence the signer will be asked to produce. Make the alarm path one person and one action, not a channel. If the record says "the team will investigate," nobody will.

The revisit date separates an exception from a waiver. Derive it from the remediation plan, not an arbitrary interval, and state it with a milestone. If the fix needs two weeks of build and one week of test with committed capacity, the revisit is end of week three, not "Q3." When the date arrives, the owner presents evidence of completion or continued blockage, and the signer signs again or the exception closes. The vendor memo pattern does this by making acceptance expire automatically unless a fresh decision is approved per this template.

Write rollback and fix triggers as conditions, not judgments:

• Rollback trigger: any confirmed incident traceable to the gap, any threshold breach unresolved past its response window, or any change to the data classification in scope.
• Immediate fix trigger: discovery that a compensating control silently failed, for example logging stopped or a rate limit was raised without approval.
• Scope reduction trigger: a request to onboard a new tenant or data category, which resets the analysis because the gap statement changes.

The record itself should follow a short pattern: context, decision, alternatives, security trade-offs, expected telemetry, and triggers for re-evaluation per this handbook. That is small enough to fill in during a launch review and complete enough to survive an audit.

GAP: <what the system cannot do, with observed numbers>
SCOPE: <system, environment, data categories, tenant count>
SCENARIO: If <trigger> while <gap>, then <asset> may <impact>.
COMPENSATING CONTROLS:
  - <control> | owner | tested <date> | evidence <where>
MONITORING: <metric> >= <threshold> -> <action> -> <who>
TRIGGERS: rollback if <condition>; fix immediately if <condition>
REMEDIATION: <change> due <date>, owner <name>
REVISIT: <date>, evidence required: <artifact>
SIGNER: <name, role, authority over the consequence>
EXPIRY: <date, automatic unless renewed>

Record two ratings, not one average: inherent exposure before safeguards and residual exposure after verified safeguards, because an average can hide a mandatory failure per this template. A single "medium" line is the record that collapses in an audit eighteen months later.

Acceptance is one of five options, and teams default to it too quickly. Compare them in the record so the signer sees the alternatives were priced.

"Do not proceed" is correct when the gap crosses a legal prohibition or a control the organization has declared non-negotiable, and those cases escalate rather than enter the exception queue per this memo guidance. "Add a control you can build fast" applies more often than teams assume, because the cheapest fixes reduce access rather than add detection: fewer tools, narrower permissions, manual approval on the one state-changing call per the LLM06 entry. The OWASP cybersecurity and governance checklist is a reasonable input here, since it is written for the cross-functional group that has to make this call, including executive, security, privacy, compliance, and engineering leaders per the checklist.

A worked example. A support agent launches next week; the gate flags that indirect prompt injection can reach a state-changing refund tool; the proper fix, a code-level approval gate, needs three weeks. You accept the risk with conditions for 21 days: the refund tool is removed from the agent and refunds route to a human queue (no build cost), the agent is limited to internal users for 14 days (scope reduction), spend is capped at a hard hourly ceiling with a circuit breaker, and the on-call owner watches refund-queue volume and tool-call rejections daily against a named threshold. The signer is the support operations lead, who owns refund errors. The revisit is day 21, with the approval gate as the required artifact. Engineering cost to the launch: the config change plus two dashboards. That is what a documented acceptance buys: the launch moves, exposure is smaller, someone owns the consequence, and the gap has an end date.

If the gap is in model access or cost control, the fix is sometimes architectural. Routing every model call through a single API with prepaid credits and a hard ceiling gives you the circuit breaker and spend metric the record needs, across text, image, video, audio, and embedding models, which also simplifies the supply chain question OWASP lists as a top-ten risk per Quanta Inference and the 2026 risk table. If the review is stalling because nobody on the team has done this before, a free 30-minute discovery call is cheaper than another week of circular review.