Break-glass

Break-glass opens a time-limited window for one person. Inside it, that person can override the Tier-0 guard, which normally protects the built-in administrator and members of the top admin groups.

Who can use it

You need all of these:

• The Tier-0 override permission (ad.tier0.override). Only an Org Owner holds it by default, and only an Owner can hand it out.
• A plan that includes the Tier-0 override feature. The server checks this when you open a window and refuses if it is missing.
• Two-factor authentication set up on your account.

Opening a window does not give you any permission you do not already hold.

Open a window

1. Open Settings, Bulk approvals.
2. Find the Tier-0 break-glass card at the top. If you lack the permission, the controls are greyed out.
3. Type a reason. It must be at least 10 characters. Say why, for the record.
4. Set the minutes. The default is 15. The longest is 60.
5. Select Open a window.

The card then shows how many minutes are left. The window closes on its own. To close it earlier, select Close it now.

What the window does

Your organisation can be set to require a window before any Tier-0 override. In that case an override outside an open window is refused with “break glass required”. If your organisation has not set that requirement, overrides work as before and a window is not needed. There is no screen in the app to switch this requirement on or off. Not yet verified on a lab: how an Owner turns it on.

If you open a new window while one is open, the old one is closed first. Each person has one window at a time.

What is recorded

• The server stores each window with who opened it, when, when it ends, and your reason.
• Not yet verified on a lab: whether opening or closing a window also writes a row you can read in the audit log. The code that opens and closes windows does not write an audit entry itself.

What it does not do

• It does not add permissions.
• It does not bypass the plan or role checks.
• It does not last longer than 60 minutes.