Register agent policy exceptions with reason, risk owner, expiry, compensating control, and audit status