Specimen V
The All-Clear
First contact
The dashboard was green. Every policy assigned, every scope covered, a compliance figure high enough to go in a board pack without a footnote. “We’re at ninety-four percent,” they said, and they were. The exempted resources were not in the denominator.
Behaviour
It begins as a reasonable exception. A legacy resource cannot meet a policy during a migration, so an exemption is written with a scope, an owner and an end date, and every part of that is correct. The migration is then deprioritised. The exemption does not expire, because expiry was a date rather than a mechanism and nothing in the estate was ever built to act on it.
The policy stays assigned and keeps reporting. Here is the part that does the damage: an exempted resource is not counted as non-compliant, it is not counted at all. The exemption does not lower the score. It removes the question. So the figure climbs while the estate does not improve, and the dashboard is not wrong — it is answering a narrower question than anyone believes it is being asked.
A missing control leaves a hole that somebody eventually falls into and notices. This one answers when it is called, in a confident voice, and says that everything is fine.
Signs of infestation
Read two settings per assignment and keep them apart, because they are routinely confused. The effect is audit or deny, and decides whether anything is blocked. The enforcement mode is Default or DoNotEnforce, and decides whether the assignment acts at all. An assignment can be present, enforcing, and still only auditing.
Then list every exemption with its expiry and its owner, sort by expiry, and take everything already past it. Check which of those owners still work there. Write down two numbers — exemptions past expiry, and how many of those have an owner who could still be asked about them. Neither number appears on the dashboard, and the first one is the size of the gap between your score and your estate.
Containment
Expiry has to be enforced by something other than intention; a date nothing acts on is a permanent change to policy, filed where nobody reads policy. Letting the exemptions lapse and moving the effect from audit to deny is the easy half. The hard half is that deny will break whatever has been quietly relying on audit for months, and no list exists of what that is — which is the same reason the exemptions were never revisited.
Recovered note
I never tell them. I ask them to walk me through it, and I quote their own words back at them until they hear it. They dig the grave themselves, with a shovel they chose and paid for.
