Emergency privileged access that auditors actually like.

A single privileged account that one person can unlock is a single point of compromise and a single point of audit failure. Auditors want separation of duties on the most dangerous credentials, not a shared password.

Break-glass secrets are split T-of-N, with T ≥ 2 enforced by a database CHECK constraint — not just application logic. An approver decrypts their share locally and re-encrypts it for the requester; the platform never holds a usable key. No individual, including a Glassbreak operator with full database access, can unlock content alone.

OTP and push-prompt MFA are phishable and fatigue-prone. For the credentials that matter most, approver identity has to be bound to hardware.

Approvals are gated by WebAuthn — a hardware-backed passkey or security key. Phishing-resistant, origin-bound, and unforgeable. A quorum of WebAuthn approvals is the strongest practical assurance that the right humans authorised the grant.

Standing privileged access is the finding auditors love to write up. Access granted for an incident and never revoked becomes tomorrow’s breach path.

Every grant is time-boxed with automatic expiry. Access exists for the window the quorum authorised and then revokes itself. Just-in-time by construction — there is no standing entitlement to forget about.

When the access review or the post-incident report comes, you need to answer who requested, who approved, what was reached, and when — without reconstructing it from logs scattered across systems.

Every request, approval, WebAuthn assertion, grant, and revoke is recorded with cryptographic integrity and exported as PDF or JSON. The break-glass timeline is the evidence — for the board, the auditor, or the supervisory authority.

A break-glass policy that depends on Slack being up fails at exactly the moment you need it. Approvers must be reachable when the primary stack is part of the outage.

Approval requests fan out over multi-channel emergency delivery — SMS, email, push, voice fallback — with acknowledgement tracking. The quorum forms even when your corporate chat is degraded.

Break-glass access is rarely an end in itself. It is step three of a recovery runbook — and the runbook should drive the grant, not a separate ad-hoc request.

Break-glass secrets are referenced directly from runnable, checkable playbooks. A recovery step requests exactly the credential it needs, under the quorum policy that step requires, with the whole run captured in one audit timeline.