Break-Glass Access
also called Emergency Access, Just-in-Time Elevation
A pre-agreed, heavily audited path to elevated privilege for emergencies, replacing standing administrative access.
Standing production access is the control weakness auditors find most reliably and engineers defend most strongly, on the reasonable grounds that during an incident nobody wants to fill in a form.
Break-glass resolves the tension by making elevation fast but conspicuous. The engineer requests elevated access through a defined mechanism, receives it in seconds, and the grant is time-bounded, tied to a stated reason or incident reference, announced to a channel where colleagues see it, fully session-logged, and automatically revoked.
What this changes: the population with standing access drops to zero or near it, so a compromised account is no longer an immediate path to production. Every use is visible and reviewed, which creates a natural feedback loop — recurring break-glass for the same task identifies a missing capability in the tooling.
The failure modes to design against are specific. The mechanism must not depend on the system that is down, which is a real risk when identity or network is the thing failing, so a genuinely independent fallback path must exist and be tested. Approval must not be a hard blocker at 3 AM, which is why notify-and-review usually beats approve-before-grant for operational access. And the review must actually happen, or the control degrades into logging.
The metric that shows it is working: break-glass usage trending down over time as tooling absorbs the recurring cases.