An enterprise administrator has enabled secret scanning with push protection across all repositories in an organization. A developer reports that when they attempt to push a commit containing an AWS access key, the push is blocked. The security team wants to allow developers to proceed in genuine emergencies but requires that every such override be recorded for later review and that a reason be captured. Which configuration meets this requirement?