Break-glass overview

If your organization grants access just-in-time through a broker such as Tenable or Entra PIM, what happens when that broker is down during an incident? Break-glass is the answer: emergency access that does not depend on the broker being available.

The problem

Just-in-time and CIEM brokers remove standing privilege — which is good — but they also become a single point of failure. If the broker is unreachable during an outage, the people who need to respond cannot elevate.

How break-glass works

Break-glass is broker-independent. It does not try to call the broker to grant access in an emergency. Instead it uses a two-object model:

• A standing emergency role — pre-provisioned, least-privilege, attested, and never expiring. It is designed up front, not minted during the incident.
• A short-lived break-glass activation — when armed and activated, it turns the emergency role on for a strict, short TTL and auto-revokes when the time is up.

This avoids the trap of live-replicating broker permissions, which would reintroduce the dependency, rebuild a standing-access blast radius and drift out of date.

Armed only when needed

Break-glass is armed when any configured broker is unhealthy. Per-connection health checks decide this automatically, so emergency access is available exactly when the normal path is not.

Still governed

Activation uses four-eyes approval, with an auto-approve-of-last-resort for the case where approvers themselves are locked out, and every step is written to the audit trail. See setting up brokers and activating break-glass.