Why does keeping a credible break-glass route available let an estate's everyday grants stay narrower than they otherwise would?

## The bargain Break-glass is usually presented as a control on emergency access. Its larger value is somewhere else: it is the argument that lets you **withdraw standing rights** without having the conversation end in "and what do we do when the payments service is down at 02:00?" The trade is explicit. You accept one path that is deliberately powerful, deliberately open to a pre-authorized group on their own initiative, and observed rather than gated. In exchange, the everyday grants across the estate can be sized for what people actually do every day, because the emergency they were secretly sized for now has its own route. ## Why the broad standing grant exists at all Almost never because anyone wanted it. It exists because the cost of being under-granted lands on an identifiable person on a bad night, while the cost of being over-granted is diffuse and shows up, if at all, in someone else's incident months later. That asymmetry reliably produces wide grants, and no amount of exhortation about least privilege changes an asymmetry. A credible emergency route changes it, because it removes the bad-night cost from the equation. The security accounting is worth stating plainly: - A broad standing grant is exposure that is **unbounded in time** and **invisible in use** — it produces no event, starts no clock, and triggers no review. - A narrow standing grant plus a rare open is exposure that is **bounded** (the time box), **attributable** (an individual identity opens it), and **reviewed** (every use, no exemptions). - The second shape is smaller in expectation even though the route's reach may be larger at its peak, because the reach exists for minutes a few times a year rather than continuously. ## What makes the bargain hold 1. **Time to open.** The single most important number. If taking the route reliably costs forty minutes of manual steps, people will not take it under pressure; they will arrange never to need it, which means holding a copy. 2. **Rehearsed and known to work.** A route people privately doubt is not a route. The first failed open, at the worst possible moment, restores every standing grant in the organisation for years. 3. **Blameless use.** The alert names who opened the route, which is observation. The moment it functions as an accusation, opening becomes a career risk and the route dies quietly. 4. **Actually withdrawing the standing grants.** The route buys nothing until the rights it replaced are removed. Keeping both is the most common way this ends. 5. **Scoped per domain.** One route that reaches everything is the standing grant again, with a time box bolted on and a larger audience. ## How it fails | Failure | What you observe | What you actually have | |---|---|---| | Route is slow or awkward | It is almost never opened, and incidents are resolved suspiciously fast | Private copies of the credentials, held indefinitely, in nobody's inventory | | Use is treated as a black mark | Zero opens over a period that plainly contained qualifying incidents | The same private copies, plus engineers who will not tell you | | Standing grants never withdrawn | Both exist and the route is used occasionally | The original exposure, plus a second path to it | | One route reaching everything | Simple governance, one list, one alert | A standing administrative grant on a timer | | Never rehearsed | Nothing at all, until the night it matters | An argument, at the worst possible time, for granting everything back | ## Setting the standard for an estate A lead is being asked how many routes there are, who owns them, and how anyone would know the arrangement is working. A defensible answer: one route per blast-radius domain rather than one master route; each owned by the team that owns the credentials it reaches, not by a central function that cannot judge the findings; each rehearsed on a cadence and on every change to its dependency chain; each use reviewed by someone independent; and the pre-authorized list re-checked against who is actually employed and on call. The measure of success is deliberately indirect: standing elevated grants across the estate trending **down**, opens of the routes at a low but **non-zero** rate, and rehearsals passing. Zero opens is not a success — either no incident needed one, or somebody found another way in. ## What an interviewer is listening for That you can argue for the route in terms of what it lets you take away, and that you can name the failure where an organisation ends up holding both the broad grant and an unused emergency path. The second half is what separates this from a slogan.