Break-Glass Access

Break-glass access is a deliberately pre-built path to elevated permissions for emergencies, designed to be used rarely, loudly and briefly. It exists because least privilege has an edge case: an incident where the person who can fix the problem does not have the access to fix it, and the approver is asleep. Teams without a defined path improvise one under pressure, which usually means a permanent administrator account with a shared password, and that account then outlives the incident by years. The design turns an emergency into a controlled event. Access is granted for a fixed short window and expires automatically rather than requiring somebody to remember to remove it. Invoking it requires a stated reason and raises an alert that goes to people other than the person invoking it, so the exception is visible in real time rather than discovered at audit. Everything done under the elevated role is logged separately and reviewed afterward as a matter of routine, not suspicion. Where possible a second person approves, with a documented single-approver path for the case where nobody else is reachable, because a control that cannot be used at three in the morning will be bypassed instead. Two things determine whether it works. It has to be tested, since an emergency path that has never been exercised fails exactly when it is needed, and a quarterly rehearsal is what finds the expired certificate or the missing account. And its frequency of use is a signal in its own right: routine invocation means normal permissions are too narrow for real work, and the fix is to widen the day-to-day role rather than let the emergency path become the ordinary one.