Blog
Notes on break-glass procedures, incident response, applied cryptography, and compliance.
Could You Recover If Your AI Agent Deleted Production?AI coding agents now hold write access to production. The question is not whether one causes an outage, but whether you could recover when it does.2026-08-02Microsoft Entra ID Break-Glass Accounts: A Setup GuideMicrosoft's own guidance says every Entra ID tenant needs at least two break-glass accounts. Here is how to set them up, store the credentials, and test them.2026-08-02Client-Side Quorum Cryptography in the BrowserHow Shamir's Secret Sharing and end-to-end encryption combine so a server can coordinate emergency access without ever holding a usable key.2026-07-17Designing Break-Glass That Survives a Cloud OutageA break-glass path that lives in the same cloud as the systems it recovers isn't a break-glass path — it's a second thing that can fail at the same time.2026-07-17Escalation Trees for When Everything Is on FireEscalation trees fail quietly until the night they matter. How to design timeout, retry, and multi-channel rules that actually reach a human.2026-07-17The 2am Test: Auditing Your Emergency AccessA runnable self-audit for break-glass access: 12 concrete checks to run against your own setup before an auditor or an outage does it for you.2026-07-17Introducing the Glassbreak BlogWhy we're starting a blog on break-glass practice, incident response, applied cryptography, and compliance — and what to expect here.2026-07-16