When you really need to make exceptions in cybersecurity, specify them as explicitly as you can.