Health Check & Service Discovery · View 20 of 21 · Assurance
What this flow proves
- The break-glass role is scoped and time-boxed, and the attempt is audited whether or not it succeeds.
- The budget guard refuses the override and returns the floor it hit, so the operator learns something rather than retrying.
- The accepted path — a declared evacuation — is reversible in one step, which is why it is the safer instrument.
Assumptions
- 15-minute credential scope; override attempts rate-limited per actor per service; justification is a required field.
Risks
- An operator who can always remove capacity is a denial-of-service path with a badge. The refusal is load-bearing, not advisory.
