Break-Glass Envelope
Emergency access that exists when you need it — and leaves a permanent record the moment it is used.
The problem
/ 01Emergency access exists so critical systems stay reachable in a crisis — but standing access is exactly what attackers want and auditors question.
What it does
/ 04Seals emergency credentials behind a tamper-evident envelope.
Breaks the seal only with a recorded reason — releasing the payload.
Lists envelopes by status (sealed or broken).
Audits every break: who, when, and why.
Who it’s for
/ 03- SRE and on-call teams holding emergency credentials
- Security teams that need a break-glass record
- Compliance teams auditing emergency access
In context
/ 01The audit feed pairs with the AI Decision Audit Trail — every break is a governance event.
Spec & limits
/ limits| Interface | Input limits | Output artifact | Failure mode | Non-claim |
|---|---|---|---|---|
Studio ephemeral /demo; pilot durable /v1 on your infrastructure. | TBD — verified in pilot acceptance | TBD — verified in pilot acceptance | TBD — verified in pilot acceptance | TBD — verified in pilot acceptance |
Related guide
/ guideSee the break-glass access audit guide for a deeper problem walkthrough and verification notes — evaluation notes for the live demo and for a private pilot. Also: try the live experiment and read the product overview.
Frequently asked questions
/ 0501 What is sealed by default, and how is it released?
The emergency credential is stored sealed until an authorized actor records a release reason; only then is it decrypted and an audit entry emitted.
02 Who can break glass — a single actor or requires approval?
Configurable — single-actor release or a multi-party approval threshold; the policy and the release are both recorded.
03 Is the break-glass event recorded immutably?
Yes — the release emits a signed, hash-chained receipt with who, when, and why; the event cannot be deleted from the audit trail.
04 Can a break-glass release be automated for incidents?
Releases require an actor and a recorded reason by default; automated rotation or alerting is wired to the receipt, not to silent credential release.
05 How does this differ from a password vault emergency access?
It focuses on the audit record — sealed by default, released only with a recorded reason — rather than on credential storage or rotation mechanics.