An audited bypass for legitimately urgent situations that would otherwise be blocked.
A break-glass workflow is the deliberate, auditable way for engineers to bypass a policy gate during a genuine emergency — a live incident, a critical customer escalation, a regulatory hotfix — when waiting for normal remediation would be worse than accepting the risk.
The name comes from the red emergency handles on factory floors: you can pull them, but you leave behind a physical record that everyone on the shift will see. A well-designed break-glass is the same idea in software — fast, clearly-marked, always-visible, and never silent.
A defensible break-glass has four moving parts:
Policy gates without a break-glass path get routed around during real incidents — someone disables the gate, forgets to re-enable it, and the control silently becomes theatre. Policy gates with a break-glass path survive contact with production. Engineers trust them because they know the escape hatch exists; security trusts them because every use leaves a record.
Break-glass data is also one of the richest sources of policy feedback you have. A rule that gets broken open three times a month is telling you something useful about itself.
Engineers do not learn to disable gates permanently because the authorised bypass is always faster and safer.
Requester, approvers, reason, incident link, and expiry are persisted — a dream for SOC 2 auditors and post-mortem teams.
Enforcement snaps back automatically. No one discovers a rule disabled for 18 months during the next audit.
A single stressed engineer cannot grant themselves a waiver — the workflow requires a second set of eyes by design.
Frequent bypasses on one rule is a signal: either the rule is wrong or the underlying process is broken. Either way, you learn.
Safeguard ships a first-class break-glass flow on every policy gate: requesters, approver groups, expiry, reason capture, and incident-review triggers are all part of the same record. Break-glass events feed the same audit export that carries normal policy verdicts. See the full guardrails and enforcement use case for the end-to-end flow.
Strict-by-default enforcement, with an auditable release valve engineers actually use in incidents — not around them.