A Sender/Recipient pair is the most precise exception because the requirement concerns communications between a particular sender and recipient, not every message involving either party. Cisco Secure Email Threat Defense policy exceptions act as exceptions to the base policy and can be matched using sender and recipient conditions. Cisco’s product update specifically describes Sender/Recipient Pair Policy Exceptions as providing more granular controls for gateway customers. Therefore, option B meets the requirement while limiting the exception’s scope. A wildcard can exempt unrelated messages and weaken enforcement. A sender-only rule would affect that sender’s mail to all recipients, while a recipient-only rule would affect messages from every sender to that recipient. Applying least privilege to email policy means defining only the exact relationship that needs special handling. Cisco Policy Exceptions supports this configuration.

================