Use a defined break-glass path: a named approver grants a short, recorded override, the release ships with the finding visible, and a follow-up review and fix plan are due within a fixed time. The override should be rare, logged and expensive enough that nobody uses it casually.
Why plan for it
Gates will block something important on the worst day. If the only way through is to disable the gate, people will disable it and forget to turn it back on. A built-in emergency path keeps the control alive while still letting the business move.
What qualifies
Define it narrowly in the policy. Typical examples: a production outage fix, a legal or contractual deadline, or a security fix that itself trips a gate on an unrelated finding. A feature launch date is not an emergency.
The break-glass steps
- Request. The engineer states the failing finding, why shipping cannot wait, and the blast radius.
- Approve. A designated approver, not the requester, grants the override. Keep a short list of people who can do this.
- Time-box. The override covers this release only, or a few hours. It is not a standing waiver.
- Ship with visibility. The finding stays open in the scanner. The release record shows the override.
- Follow up. Within a set time, such as one or two business days, hold a review: fix, mitigate, or convert to a normal exception with full approval.
What to record
| Field | Why |
|---|---|
| Finding and asset | Scope of the override |
| Requester and approver | Separation of duties |
| Reason | Shows it met the emergency definition |
| Start and end time | Proves it was time-boxed |
| Follow-up owner and date | Closes the loop |
Watch the usage
Count break-glass uses each month. A rising count means the gate is tuned badly, or teams do not trust the process. Both are fixable. A count of zero for a long time is also worth a look, because someone may be bypassing the path instead of using it. Pair the review with the ideas in pr-time policy gates that developers accept.
Where Safeguard fits
Safeguard policies and gates can block a pull request on a finding and keep a recorded override with the approver, so an emergency exception stays in the audit trail.
Try it yourself
Click through it at your own pace, or open it full screen. Look at what makes the gate fail, since that is the moment an override would be requested.
Quick check
Can the on-call engineer approve their own override?
No. Another named approver should grant it, even at night, using a short on-call approver list.
How long should an emergency override last?
Only as long as the release needs it, usually hours, with a follow-up due within a day or two.
Last reviewed: 19 October 2026.
