How do I run a break-glass override for an AI agent so an emergency can bypass a normal gate, with a short TTL and a full audit trail the agent cannot edit?

What should I check, step by step?

1. Define the only conditions that may invoke break-glass (for example: production outage with customer impact, safety incident, or owner locked out of the normal approver path). Ban convenience and routine troubleshooting.

2. Make the override itself dual-controlled or restricted to a named owner role. The person who benefits from the widened scope should not be the sole person who can open it.
3. Bind the override to a short hard TTL (for example 15–60 minutes), a named reason, a ticket or incident id, the agent or credential id, and the exact scope being widened (tools, environments, spend ceiling).
4. Write a loud, append-only ledger entry at open and at close: who authorized, who used it, start, planned expiry, actual end, reason, ticket, scope delta. The agent's API key must not be able to UPDATE or DELETE those rows.
5. Auto-revert when the TTL ends: restore the prior policy, revoke temporary grants, and notify owners on open, on expiry and on any manual extension (extensions should themselves be dual-controlled).
6. During the window, keep normal logging on: every tool call, every spend, every permission change. Prefer session recording or an outside-agent flight recorder for the override window.
7. After every use, run a post-event review within a fixed window (for example 24–72 hours): was the trigger legitimate, was scope minimal, what must be fixed so the next emergency does not need break-glass?
8. Drill quarterly: open a break-glass in a non-production environment, confirm the loud entry, confirm auto-revert and notifications, then revoke. An undrilled path fails when you need it.

What is a break-glass override for an AI agent?

Break-glass is an emergency exception to normal agent gates: a temporary widen of scope or a bypass of a waiting approval when waiting would make the incident worse. It is not a standing admin mode, not a shared root password, and not a way to skip policy because someone is in a hurry.

• NIST SP 800-53 Rev. 5 AC-3(10) (audited override of access control mechanisms) and AC-2(2) (automated temporary and emergency account management) are the control language: define the conditions and roles, time-bound the access, and audit every use. FedRAMP and federal IAM guidance treat the same pattern for privileged emergency access.
• How to build a kill switch for an autonomous AI agent is the stop path (revoke_agent). How to put expiry and timed re-approval on agent escalation thresholds covers raising limits with a clock. This page is the rare override that widens or bypasses, then snaps shut with a trail.

How do dual control, short TTL, reason and ticket work for agent break-glass?

Require a human authorization to open the window: request_human_approval with an action that names break_glass, the scope delta, reason and ticket_id, or declare_intent with the same fields so the agent's allowed operations for that window are explicit. Prefer two independent humans for high-blast-radius overrides.

• Hard-expire the grant. Soft reminders are not enough; the gateway must deny the widened scope the moment the TTL passes, even if the incident channel is still busy. Any extension is a new approval, not an edit of the old one.
• Name the reason and the ticket or incident id in the approval action and in the ledger entry. Verbal-only overrides with no record fail every later review; if the ticketing system is down, accept a time-stamped out-of-band record and link it when systems recover.

How do I keep a loud audit trail, auto-revert and drills for agent break-glass?

On open, write a high-severity entry the agent cannot suppress: override_id, agent or credential id, authorizer ids, reason, ticket_id, scope_before, scope_after, opened_at, expires_at. On close (auto or manual), write closed_at, close_reason and whether auto-revert succeeded.

• Rightshold's ledger is hash-chained and signed; ledger_verify is free and keyless. record_ai_run can seal model and tool activity during the window; revoke_agent ends the credential immediately if the override is abused or the emergency turns into a compromise.
• Notify on open, on expiry and on failed revert. Schedule drills so on-call staff have opened and closed a break-glass in staging before a real incident. Post-event review every real use and track repeats that should become a normal, narrower path instead.