Activate break-glass
How a responder activates emergency access, how approval works, and how access auto-revokes.
Online version, always current: https://cloudvision360.com/docs/cloudvision360/break-glass-activate/
When a broker is down and someone needs emergency access, this is the path from request to revocation.
Arming
Break-glass arms itself automatically when any configured broker is unhealthy, based on each connection’s health checks and its failures-to-arm threshold. When nothing is wrong, break-glass stays disarmed and the normal just-in-time path is used.
Request activation
A responder opens Break-glass, selects the pre-provisioned emergency role they need and the scope, and requests activation with a reason. The request is recorded immediately in the audit trail.
Approval (four-eyes)
Activation needs a second person’s approval. Because an incident may lock out the usual approvers, the policy can allow an auto-approve of last resort — a strictly bounded fallback that still records who, when and why. You decide in the policy whether to allow it.
Access, then automatic revocation
On approval, the emergency role is turned on for a short, strict TTL. When the TTL ends, the break-glass activation auto-revokes — access does not linger after the emergency. You can also revoke early once the incident is over.
After the incident
Every activation, approval and revocation is in the audit trail, and the emergency role returns to its standing, unused state. Review activations as part of your incident retrospective.