Letting humans into production

A field guide to the human-access plane: the three legitimate doors into production (automation, pre-validated tooling, audited break-glass), why none of the six investigated breaches defeated an approval gate, and the conditions that flip every major access decision. A reader leaves with a decision tree for standing versus just-in-time access, a four-class failure catalogue with transferable design rules, a seven-rung build ladder that crosses from toy to production-shaped at the emergency plane, and the search method that surfaced the evidence.

What you get out of it

• Approval workflows protected none of the breached companies; standing credentials, stolen sessions and unrotated keys made the gates irrelevant, so zero standing privilege and short sessions matter more than the approval step.
• The break-glass path must share nothing with the systems it backs up: four independent designs (Microsoft Entra, Teleport, Login.gov, Kubernetes kubeadm) all place the emergency credential outside the SSO chain.
• Google removed standing operator access and measured a reliability dividend; GitLab keeps it for a small senior group and is still arguing with itself in public. The flip is your operational surface: many services favour Google's model, one deep application favours GitLab's.
• 'Believed unused' is not a security state: Cloudflare's four missed credentials, Microsoft's 2016 key and Okta's saved service account all show that a credential you cannot prove is dead is alive.
• Nobody in the corpus publishes their break-glass usage rate, the number that would reveal whether the third door is being overused; measuring it yourself is the only defence against the control degrading silently.

Scope

Why this, now. Just-in-time access and zero-standing-privilege moved from Google-scale practice into mid-size engineering orgs between 2022 and 2025 (Mercari, Figma, GitLab publishing openly), while the 2022-2024 breach reports (Uber, CircleCI, Okta, Cloudflare, Microsoft/CSRB) gave the first well-documented corpus of how human access actually fails in production.

What it does not cover. Product-side authorization for end users, service-to-service workload identity, the hour after a machine credential leaks, and the deploy pipeline as an attack surface, each covered by a separate dig in this collection. It does not cover any organisation's break-glass usage rate, which no source in the corpus publishes.