Go back to the 2am fix, and this time stop on the single most important action in the whole event. It was not the deploy. It was the yes.
Before any code shipped, someone with a credential made a decision: override the check, skip the review, push past the gate that normally stands in the way. Under real pressure, with the incident live, that call has to be available to someone. A system that cannot be overridden in an emergency is a system that fails shut at the worst possible moment. So the override is not the problem, and none of this is an argument for removing it. You governed what your agents can reach, and you were right to; this is about the human standing next to them at 2am, holding a credential. Emergencies need a yes.
The yes with no author
The problem is what the yes leaves behind, which in most enterprises is nothing. Break-glass, in practice, is a shared administrator login in a password vault and a control someone knows how to switch off. In the emergency, a person grabs the credential, disables the check, makes the change, and the incident resolves. Then the moment closes. There is no record of who decided, what exactly they were authorizing, or when that authority was supposed to end — because nothing in the path was built to capture a decision. It was built to get out of the way. The override worked, and it worked by leaving the governed system entirely. Ask a week later who approved it and under what authority, and you are back in the Slack thread, reconstructing from memory.
Keep the yes, give it an author
The fix is not to make emergencies harder. It is to make the yes a decision the system records, instead of a door the system opens. Break-glass done right stays inside the boundary, and the override becomes an authorization with three things it did not have before. An author: a specific person's credential, not a shared login, so the yes has a name on it. A scope: this action, on this system, for this incident — not a skeleton key to everything. And an expiry: the authority ends on a clock, on its own, so an emergency grant cannot quietly harden into a standing permission. The person still says yes under pressure, in seconds, without waiting on a committee. What changed is that the system was standing between them and the action, and it caught the decision on the way through.
Not a door out, and not an off switch
This is worth being precise about, because break-glass is easy to picture as the opposite of what it is. It is not a door out of the governed system into an ungoverned free-for-all; the whole point is that the emergency action stays on the same governed plane as everything else, recorded more carefully than a routine change, not less. And it is not an off switch. It does not halt anything or stand the controls down; it authorizes one specific action, under stated limits, and keeps the record of having done so. The emergency is governed, not exempted. That distinction is the entire value, because the moment you would most want to reconstruct later is exactly the moment most systems stop recording — and this one keeps recording precisely then.
The reckoning after
An expiry does one more thing: it forces a reckoning. Because the authority ends on its own, someone has to come back to the emergency in daylight — to extend it deliberately, close it out, or move the temporary change onto the normal path and make it permanent the ordinary way. The override cannot simply persist because everyone moved on to the next fire. Adjudicating the break-glass after the fact stops being something you might do if you remember, and becomes something the expiry requires. The record it leaves is not the point in itself; it is what makes that after-the-fact judgment possible at all, and what a board or an auditor can actually read.
Authorized inside
Authorized inside, detected outside. This post is the first half. Inside the boundary, every action carries a recorded allow-or-deny decision before it runs, and the emergency yes — the one action you would most expect to escape that rule — is no exception. It is an authorization like any other, only made in seconds under pressure, with an author, a scope, and an expiry attached to it. The other half of the spine is the harder case: what happens when someone does not ask for a yes at all, and simply goes around the system entirely. That is the next piece.
For now the claim is smaller, and worth banking on its own. Reconstruct that emergency one more time. If the most consequential decision in it was a yes said at 2am, the question is only whether that yes had a name, a boundary, and an end — or whether it is still the one approval in your company with no author. It does not have to be.