What is break-glass access?

Break-glass access is a pre-arranged way for an authorized person to bypass a normal security control during an emergency, on the condition that the bypass is short, requires a stated reason and is visible to everyone who reviews the logs.

Why it exists

Strict rules occasionally block legitimate work at the worst moment. Production is down, the on-call engineer is away from the office network, and the secret they need is served only to that network. Without a sanctioned path, people improvise: they share credentials in chat, relax the rule and forget to restore it, or copy secrets to a laptop "just this once." A break-glass path replaces improvisation with a procedure that leaves a clear trail.

The name comes from the fire alarm behind glass: anyone can use it, but nobody does so quietly.

What a good break-glass path looks like

• Limited to a few people. Usually owners, not every member.
• Time-boxed. It expires on its own.
• Justified. The person writes down why.
• Loud. An alert goes out at the moment it is used, not at the next review.
• Reviewed. Someone checks afterwards whether it was needed, and whether a value should be reissued.

How Crunu does it

In Crunu, break-glass access applies to network rules. When an environment is restricted to certain networks, an owner can open Break-glass access… to receive its contents from outside those networks for up to 60 minutes. Opening it requires a reason, raises an alert, and is recorded in the audit log as an owner break-glass access. It can be revoked before it expires.

It is deliberately narrow:

• It bypasses network rules only. It does not grant anyone an environment key they don't already have, because the bypass is enforced by the server, while reading still requires the key.
• It is for owners, not admins or members.
• Alerts go to the organization's alert feed and, if configured, to webhook and email channels.

Crunu uses the term break-glass rather than "emergency access" because Emergency Kit already names something different: the printable sheet with your Secret Key. See network rules and alerts.