{
  "question": "How do I run a break-glass override for an AI agent so an emergency can bypass a normal gate, with a short TTL and a full audit trail the agent cannot edit?",
  "slug": "how-to-run-a-break-glass-override-for-an-ai-agent-with-a-full-audit-trail",
  "url": "https://www.rightshold.com/answers/how-to-run-a-break-glass-override-for-an-ai-agent-with-a-full-audit-trail",
  "short_answer": "A break-glass path is a rare, deliberate emergency override: it temporarily widens an agent's scope or bypasses a normal approval gate when the ordinary path cannot wait (outage, safety incident, locked-out owner). Treat it as louder than a normal approval, not quieter. Make the override itself dual-controlled or owner-only; give it a short hard TTL (minutes, not days); require a reason and a ticket or incident id; write a high-severity ledger entry the agent's credentials cannot edit or delete; auto-revert when the TTL ends and notify owners; and drill the path on a schedule so the first real use is not the first test. NIST SP 800-53 AC-3(10) calls this an audited override of access control: allowed only under defined conditions, by defined roles, and always audited. request_human_approval (or declare_intent with a break_glass flag in the action) records the human authorization; record_ai_run seals what happened during the window; revoke_agent is the kill switch if the override goes wrong.",
  "checklist": [
    "Define the only conditions that may invoke break-glass (for example: production outage with customer impact, safety incident, or owner locked out of the normal approver path). Ban convenience and routine troubleshooting.",
    "Make the override itself dual-controlled or restricted to a named owner role. The person who benefits from the widened scope should not be the sole person who can open it.",
    "Bind the override to a short hard TTL (for example 15–60 minutes), a named reason, a ticket or incident id, the agent or credential id, and the exact scope being widened (tools, environments, spend ceiling).",
    "Write a loud, append-only ledger entry at open and at close: who authorized, who used it, start, planned expiry, actual end, reason, ticket, scope delta. The agent's API key must not be able to UPDATE or DELETE those rows.",
    "Auto-revert when the TTL ends: restore the prior policy, revoke temporary grants, and notify owners on open, on expiry and on any manual extension (extensions should themselves be dual-controlled).",
    "During the window, keep normal logging on: every tool call, every spend, every permission change. Prefer session recording or an outside-agent flight recorder for the override window.",
    "After every use, run a post-event review within a fixed window (for example 24–72 hours): was the trigger legitimate, was scope minimal, what must be fixed so the next emergency does not need break-glass?",
    "Drill quarterly: open a break-glass in a non-production environment, confirm the loud entry, confirm auto-revert and notifications, then revoke. An undrilled path fails when you need it."
  ],
  "sections": [
    {
      "heading": "What break-glass is (and is not)",
      "points": [
        "Break-glass is an emergency exception to normal agent gates: a temporary widen of scope or a bypass of a waiting approval when waiting would make the incident worse. It is not a standing admin mode, not a shared root password, and not a way to skip policy because someone is in a hurry.",
        "NIST SP 800-53 Rev. 5 AC-3(10) (audited override of access control mechanisms) and AC-2(2) (automated temporary and emergency account management) are the control language: define the conditions and roles, time-bound the access, and audit every use. FedRAMP and federal IAM guidance treat the same pattern for privileged emergency access.",
        "How to build a kill switch for an autonomous AI agent is the stop path (revoke_agent). How to put expiry and timed re-approval on agent escalation thresholds covers raising limits with a clock. This page is the rare override that widens or bypasses, then snaps shut with a trail."
      ]
    },
    {
      "heading": "Dual control, short TTL, reason and ticket",
      "points": [
        "Require a human authorization to open the window: request_human_approval with an action that names break_glass, the scope delta, reason and ticket_id, or declare_intent with the same fields so the agent's allowed operations for that window are explicit. Prefer two independent humans for high-blast-radius overrides.",
        "Hard-expire the grant. Soft reminders are not enough; the gateway must deny the widened scope the moment the TTL passes, even if the incident channel is still busy. Any extension is a new approval, not an edit of the old one.",
        "Name the reason and the ticket or incident id in the approval action and in the ledger entry. Verbal-only overrides with no record fail every later review; if the ticketing system is down, accept a time-stamped out-of-band record and link it when systems recover."
      ]
    },
    {
      "heading": "Loud ledger entry, auto-revert and drills",
      "points": [
        "On open, write a high-severity entry the agent cannot suppress: override_id, agent or credential id, authorizer ids, reason, ticket_id, scope_before, scope_after, opened_at, expires_at. On close (auto or manual), write closed_at, close_reason and whether auto-revert succeeded.",
        "Rightshold's ledger is hash-chained and signed; ledger_verify is free and keyless. record_ai_run can seal model and tool activity during the window; revoke_agent ends the credential immediately if the override is abused or the emergency turns into a compromise.",
        "Notify on open, on expiry and on failed revert. Schedule drills so on-call staff have opened and closed a break-glass in staging before a real incident. Post-event review every real use and track repeats that should become a normal, narrower path instead."
      ]
    }
  ],
  "checks": [],
  "ask_rightshold": {
    "start": "https://www.rightshold.com/start?ref=seo",
    "mcp_endpoint": "https://www.rightshold.com/mcp",
    "ask": "Open a break-glass override for my on-call agent: widen its production restart scope for 30 minutes only, bound to incident INC-9042 and reason 'api outage', require my approval, write a loud ledger entry, and auto-revert when the TTL ends.",
    "mcp_call": {
      "tool": "request_human_approval",
      "arguments": {
        "summary": "break-glass: widen on-call agent to production restart for 30m under incident INC-9042",
        "action": {
          "type": "break_glass",
          "agent": "oncall-ops-bot",
          "credential_id": "crd_…",
          "scope_delta": [
            "prod:restart_service"
          ],
          "reason": "api outage — normal approver path unavailable",
          "ticket_id": "INC-9042",
          "ttl_minutes": 30,
          "policy_id": "break-glass",
          "policy_version": "v3"
        },
        "expires_in_minutes": 15
      }
    },
    "also": [
      "Needs your API key. decide_human_approval (owner account key) signs the override authorization onto the ledger; verify_human_approval is free and checks the receipt still matches the break_glass action.",
      "declare_intent can state the widened operations and ttl for the window; actions outside that intent stay refused when enforce is true.",
      "record_ai_run seals what the agent did during the override; ledger_verify is free and keyless.",
      "revoke_agent is the kill switch if the override is abused or the emergency becomes a compromise; check_revocation is free."
    ],
    "scope": "Rightshold records human approvals, intents, AI-run receipts and revocations on a signed, hash-chained ledger. Enforcing a hard TTL, dual control for the override itself, auto-revert of your internal grants and post-event review are controls you run around those records. Rightshold does not decide when an emergency is real. Not legal advice."
  },
  "sources": [
    {
      "title": "NIST SP 800-53 Rev. 5: AC-3(10) (audited override) and AC-2(2) (temporary and emergency accounts)",
      "url": "https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final"
    },
    {
      "title": "RFC 6962: Certificate Transparency (append-only Merkle hash logs)",
      "url": "https://www.rfc-editor.org/rfc/rfc6962"
    },
    {
      "title": "EU AI Act, Regulation (EU) 2024/1689: Article 14 (human oversight) and Article 12 (record-keeping)",
      "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"
    },
    {
      "title": "NIST AI Risk Management Framework (AI RMF 1.0)",
      "url": "https://www.nist.gov/itl/ai-risk-management-framework"
    },
    {
      "title": "Human approvals on Rightshold",
      "url": "https://www.rightshold.com/human-approvals"
    },
    {
      "title": "Agent kill-switch on Rightshold",
      "url": "https://www.rightshold.com/kill-switch"
    }
  ],
  "related": [
    {
      "title": "How to build a kill switch for an autonomous AI agent",
      "url": "https://www.rightshold.com/answers/how-to-build-a-kill-switch-for-an-autonomous-ai-agent"
    },
    {
      "title": "How to put expiry and timed re-approval on agent escalation thresholds",
      "url": "https://www.rightshold.com/answers/how-to-put-expiry-and-timed-re-approval-on-agent-escalation-thresholds"
    },
    {
      "title": "How to require two independent approvals before an AI agent acts",
      "url": "https://www.rightshold.com/answers/how-to-require-two-independent-approvals-before-an-ai-agent-acts"
    },
    {
      "title": "How to keep an agent risk approval record outside the agent's editable session",
      "url": "https://www.rightshold.com/answers/how-to-keep-an-agent-risk-approval-record-outside-the-agents-editable-session"
    }
  ],
  "computed_from": "Curated guidance; license verdicts computed from Rightshold's license profiles at render time. Not legal advice.",
  "updated": "2026-11-07"
}