An approved, time-boxed deviation: a control not applied, a policy not met. Governance without waivers is fiction; modeling them keeps the record honest. Approval records (who, in what role) come from the role model.