Emergency access: break-glass accounts and a time-boxed override

Purpose

Approval on privileged activation is right until the approver is unreachable during an outage. A safe emergency path has to exist before it is needed.

Design

The break-glass account list is stored in PIM Manager's database and read by the Manager and the engine; a change to it is a request that a second SuperAdmin approves, unless self-approval is on. In an emergency a SuperAdmin enters a passphrase, checked against a secret in your key vault, with a lockout after repeated wrong attempts. The override lifts the approval requirement for the PIM for Groups groups it names; a blank group list means each approval-protected group. It lasts 4 hours by default and at most 24, the owners are notified, each step is audited, and approval policy returns when the window ends or with Restore now. Home shows whether an override is active, who started it and when it ends.

Business opportunities

Strict approval policies without the fear of locking yourself out during an incident.