1 min lesson
Break-glass without permanent backdoors
For each case in "Break-glass without permanent backdoors", name the signal and the response you would use.
Step 1 of 2
Break-glass without permanent backdoorsincidents are when controls get bypassed badly
At 3am during an outage, nobody should be blocked waiting for an approver who is asleep. But the fix for that cannot be a standing god-mode role, because that role is the exact thing you spent the rest of the design eliminating. Break-glass is a controlled escape hatch with its own rules.
Self-service elevation that works without an approver, but fires a loud alert to the security channel the moment it's used.
Same TTL and auto-revoke as any other grant - the emergency doesn't buy permanence.
Mandatory post-hoc review: every break-glass use is read by a human within a day.
A shared admin account whose credentials live in a password manager.
A standing "on-call" role nobody revokes because removing it might break the next incident.
Silent elevation that no one notices until the audit, if anyone audits at all.