Exception and retention hold API

Creates an admission-exception request awaiting approval.

Send policy_id, policy_revision, resource or project scope, allowed_action, required reason, owner_team_id, and expires_at. The expiry must satisfy the policy's maximum exception duration.

Returns 201 with an awaiting_approval exception. It has no effect on admission until an authorized approver accepts that revision. Unsupported action classes or a scope outside the caller's authority reject creation.

Approves an exception for the reviewed policy revision.

Requires exception-approval permission, governance:write, and If-Match. A policy revision change returns 412 policy_revision_changed and requires reevaluation. An exception does not bypass writer ownership or fencing.

Returns approval, effective scope, expiry, and resource IDs created through the exception. Requires governance:read. Expiry blocks new use but does not delete those resources. Revocation follows the same new-admission boundary.

Creates a retention hold for a recovery point and its required members.

Requires backups:hold. Send required reason and owner team, with optional review_at. Returns 201 with the hold ID and retained member set.

A complete consistency-group hold includes all required member snapshots or backup members. review_at is a review reminder, not automatic expiry. A hold cannot restore objects already removed before its creation.

Releases an Infra retention hold.

Requires backups:hold_release, the hold ETag, and a reason. It returns the updated hold with release actor and time.

Releasing an Infra hold leaves a provider-enforced retention lock intact. Ordinary retention cleanup can expire a point once all remaining hold and policy requirements permit it. The release response identifies current retention reasons rather than reporting unconfirmed physical deletion.

Revokes an exception for subsequent admission.

Requires If-Match and a reason. Revocation prevents new admission relying on this exception. Existing resources and already accepted operations retain their own lifecycle.