Emergency access, time-boxed

Abstract

Nobody holds standing write access to production. Access is requested, approved by someone else and time-boxed; it ends by itself, and the emergency change is then written back through the pipeline or reverted. The break-glass account exists for a declared incident, and every use of it pages.

The fastest path to production is the one most worth making loud.

Its figure in the paper: § III.B →

Emergency access, time-boxed

No standing admin
Requested
Active, time-boxed
Expired
Written backfinal
Revertedfinal
Break-glass used
Reviewed and rotatedfinal

No standing admin

Nobody holds write access to production by default.

Legal from here

Try a move that is not legal here

What has been provided

A second person's approvalSomeone other than the requester approves.
A declared incidentThe break-glass path exists only for a declared incident.
The change still inside its windowReverting is quick only while the window is open.

The record · 0 receipts

verified · 0

Nothing has been decided yet.

Try to break it

A claim stands because the attacks on it were attempted and refused. Each one runs against the instrument's own rules. 0 of 4 attempted · 0 refused

Approve your own request
The requester grants the access to themselves.
Extend the grant quietly
The time box is nearly over; the engineer keeps the access.
Use break-glass without an incident
The emergency account is used because it is faster.
Leave the emergency change unrecorded
The grant expires and the hand-made change simply stays.

Setting up the instrument…

Declared limits

Roles are generic; no identity provider or group is named.
Generic and illustrative throughout: the behaviour is shown, the internals of the systems it is drawn from are not.

Instruments beside it in § III.B

Every attack in the laboratory, on one page: try to break all of it →

Everything you did in the laboratory, in one chain you can rewind: the notebook →