# Cannot modify rule exceptions post upgrade to 9.1.4
**URL:** https://discuss.elastic.co/t/cannot-modify-rule-exceptions-post-upgrade-to-9-1-4/382216
**Category:** Elastic Security
**Created:** [September 25, 2025, 9:21am UTC](https://discuss.elastic.co/t/cannot-modify-rule-exceptions-post-upgrade-to-9-1-4/382216 "2025-09-25T09:21:27Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@michael-a](https://discuss.elastic.co/u/michael-a)
#### Post date: [September 25, 2025, 9:21am UTC](https://discuss.elastic.co/t/cannot-modify-rule-exceptions-post-upgrade-to-9-1-4/382216/1 "2025-09-25T09:21:27Z")
Since upgrading from 8.17.10 via 18.19.3 to 9.1.4, we’ve encountered an issue with rule exceptions for users without superuser privileges in that it’s possible to create rule exceptions but once created, it takes superuser access to modify the exception. Having examined the list of individual role privileges, it doesn’t appear to be a specific permission that would enable that either.. Bug or feature?
---
### Author:  [@vitaliidm](https://discuss.elastic.co/u/vitaliidm)
#### Post date: [September 30, 2025, 4:24pm UTC](https://discuss.elastic.co/t/cannot-modify-rule-exceptions-post-upgrade-to-9-1-4/382216/2 "2025-09-30T16:24:16Z")
Hey @michael-a
Can you please share the role of the user, who can create an exception but can’t edit it?
Can you also share the error you encounter while editing exception by that user?
Is this exception in rule or in shared exception list?
Any additional information that would help me to reproduce issue is welcome.
Make sure, you don’t share any sensitive information.
---
### Author:  [@michael-a](https://discuss.elastic.co/u/michael-a)
#### Post date: [October 8, 2025, 10:25am UTC](https://discuss.elastic.co/t/cannot-modify-rule-exceptions-post-upgrade-to-9-1-4/382216/3 "2025-10-08T10:25:25Z")
Hi [Vitalii](https://discuss.elastic.co/u/vitaliidm),
a bit of a late reply, been away but here’s hopefully answers to your questions.
The role we use is our own, but it hasn’t changed between the releases - it’s given full control to Security and can add new rule exception but not alter exceptions - not even exceptions created by the itself. It also has full control of Rule Settings in the Management section.
The error is just a sign, when hovering over the 3 dots to alter an existing exception, the pointer changes to a stop sign preventing changing or deleting an exception.
We’ve modified the role to see if it was some setting that needed updating, but to no avail. Not sure what other information I could provide, but let me know if there’s anything else you want me provide or try out.
Thanks // Michael