Decision Records and accepted risk

The record is the reviewable output

A Security Decision Record binds the release candidate, decision, coverage state, policy versions, reason codes, and evidence digests. In managed CI the backend creates the authoritative immutable record after evaluating validated evidence.

Accepted risk is a governed decision

Accepting risk records an owner, scope, rationale, and lifecycle around an exception. It does not rewrite the original finding, lower its intrinsic severity, or pretend the evidence disappeared.

Keep assessment and authorization separate

• The assessment says what the evidence supports.
• The release decision says what policy allows now.
• An approval records who authorized an exception and why.
• Revocation and expiry change the authorization state, not the historical evidence.

What do I do with this?

Use Release approvals for the exception workflow. Then connect ownership and follow-up through remediation and fix verification. See the public Security Decision Record for a reviewable example.