# How do I run a break-glass override for an AI agent so an emergency can bypass a normal gate, with a short TTL and a full audit trail the agent cannot edit?

**Short answer:** A break-glass path is a rare, deliberate emergency override: it temporarily widens an agent's scope or bypasses a normal approval gate when the ordinary path cannot wait (outage, safety incident, locked-out owner). Treat it as louder than a normal approval, not quieter. Make the override itself dual-controlled or owner-only; give it a short hard TTL (minutes, not days); require a reason and a ticket or incident id; write a high-severity ledger entry the agent's credentials cannot edit or delete; auto-revert when the TTL ends and notify owners; and drill the path on a schedule so the first real use is not the first test. NIST SP 800-53 AC-3(10) calls this an audited override of access control: allowed only under defined conditions, by defined roles, and always audited. request_human_approval (or declare_intent with a break_glass flag in the action) records the human authorization; record_ai_run seals what happened during the window; revoke_agent is the kill switch if the override goes wrong.

## Checklist
1. Define the only conditions that may invoke break-glass (for example: production outage with customer impact, safety incident, or owner locked out of the normal approver path). Ban convenience and routine troubleshooting.
2. Make the override itself dual-controlled or restricted to a named owner role. The person who benefits from the widened scope should not be the sole person who can open it.
3. Bind the override to a short hard TTL (for example 15–60 minutes), a named reason, a ticket or incident id, the agent or credential id, and the exact scope being widened (tools, environments, spend ceiling).
4. Write a loud, append-only ledger entry at open and at close: who authorized, who used it, start, planned expiry, actual end, reason, ticket, scope delta. The agent's API key must not be able to UPDATE or DELETE those rows.
5. Auto-revert when the TTL ends: restore the prior policy, revoke temporary grants, and notify owners on open, on expiry and on any manual extension (extensions should themselves be dual-controlled).
6. During the window, keep normal logging on: every tool call, every spend, every permission change. Prefer session recording or an outside-agent flight recorder for the override window.
7. After every use, run a post-event review within a fixed window (for example 24–72 hours): was the trigger legitimate, was scope minimal, what must be fixed so the next emergency does not need break-glass?
8. Drill quarterly: open a break-glass in a non-production environment, confirm the loud entry, confirm auto-revert and notifications, then revoke. An undrilled path fails when you need it.

## What is a break-glass override for an AI agent?
- Break-glass is an emergency exception to normal agent gates: a temporary widen of scope or a bypass of a waiting approval when waiting would make the incident worse. It is not a standing admin mode, not a shared root password, and not a way to skip policy because someone is in a hurry.
- NIST SP 800-53 Rev. 5 AC-3(10) (audited override of access control mechanisms) and AC-2(2) (automated temporary and emergency account management) are the control language: define the conditions and roles, time-bound the access, and audit every use. FedRAMP and federal IAM guidance treat the same pattern for privileged emergency access.
- How to build a kill switch for an autonomous AI agent is the stop path (revoke_agent). How to put expiry and timed re-approval on agent escalation thresholds covers raising limits with a clock. This page is the rare override that widens or bypasses, then snaps shut with a trail.

## How do dual control, short TTL, reason and ticket work for agent break-glass?
- Require a human authorization to open the window: request_human_approval with an action that names break_glass, the scope delta, reason and ticket_id, or declare_intent with the same fields so the agent's allowed operations for that window are explicit. Prefer two independent humans for high-blast-radius overrides.
- Hard-expire the grant. Soft reminders are not enough; the gateway must deny the widened scope the moment the TTL passes, even if the incident channel is still busy. Any extension is a new approval, not an edit of the old one.
- Name the reason and the ticket or incident id in the approval action and in the ledger entry. Verbal-only overrides with no record fail every later review; if the ticketing system is down, accept a time-stamped out-of-band record and link it when systems recover.

## How do I keep a loud audit trail, auto-revert and drills for agent break-glass?
- On open, write a high-severity entry the agent cannot suppress: override_id, agent or credential id, authorizer ids, reason, ticket_id, scope_before, scope_after, opened_at, expires_at. On close (auto or manual), write closed_at, close_reason and whether auto-revert succeeded.
- Rightshold's ledger is hash-chained and signed; ledger_verify is free and keyless. record_ai_run can seal model and tool activity during the window; revoke_agent ends the credential immediately if the override is abused or the emergency turns into a compromise.
- Notify on open, on expiry and on failed revert. Schedule drills so on-call staff have opened and closed a break-glass in staging before a real incident. Post-event review every real use and track repeats that should become a normal, narrower path instead.

## Ask Rightshold (free, no key)
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code (one-click setup: https://www.rightshold.com/start?ref=seo), then ask: "Open a break-glass override for my on-call agent: widen its production restart scope for 30 minutes only, bound to incident INC-9042 and reason 'api outage', require my approval, write a loud ledger entry, and auto-revert when the TTL ends."

```json
{
  "tool": "request_human_approval",
  "arguments": {
    "summary": "break-glass: widen on-call agent to production restart for 30m under incident INC-9042",
    "action": {
      "type": "break_glass",
      "agent": "oncall-ops-bot",
      "credential_id": "crd_…",
      "scope_delta": [
        "prod:restart_service"
      ],
      "reason": "api outage — normal approver path unavailable",
      "ticket_id": "INC-9042",
      "ttl_minutes": 30,
      "policy_id": "break-glass",
      "policy_version": "v3"
    },
    "expires_in_minutes": 15
  }
}
```
- Needs your API key. decide_human_approval (owner account key) signs the override authorization onto the ledger; verify_human_approval is free and checks the receipt still matches the break_glass action.
- declare_intent can state the widened operations and ttl for the window; actions outside that intent stay refused when enforce is true.
- record_ai_run seals what the agent did during the override; ledger_verify is free and keyless.
- revoke_agent is the kill switch if the override is abused or the emergency becomes a compromise; check_revocation is free.

_Rightshold records human approvals, intents, AI-run receipts and revocations on a signed, hash-chained ledger. Enforcing a hard TTL, dual control for the override itself, auto-revert of your internal grants and post-event review are controls you run around those records. Rightshold does not decide when an emergency is real. Not legal advice._

## Sources
- [NIST SP 800-53 Rev. 5: AC-3(10) (audited override) and AC-2(2) (temporary and emergency accounts)](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
- [RFC 6962: Certificate Transparency (append-only Merkle hash logs)](https://www.rfc-editor.org/rfc/rfc6962)
- [EU AI Act, Regulation (EU) 2024/1689: Article 14 (human oversight) and Article 12 (record-keeping)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)
- [NIST AI Risk Management Framework (AI RMF 1.0)](https://www.nist.gov/itl/ai-risk-management-framework)
- [Human approvals on Rightshold](https://www.rightshold.com/human-approvals)
- [Agent kill-switch on Rightshold](https://www.rightshold.com/kill-switch)

## Related
- [How to build a kill switch for an autonomous AI agent](https://www.rightshold.com/answers/how-to-build-a-kill-switch-for-an-autonomous-ai-agent)
- [How to put expiry and timed re-approval on agent escalation thresholds](https://www.rightshold.com/answers/how-to-put-expiry-and-timed-re-approval-on-agent-escalation-thresholds)
- [How to require two independent approvals before an AI agent acts](https://www.rightshold.com/answers/how-to-require-two-independent-approvals-before-an-ai-agent-acts)
- [How to keep an agent risk approval record outside the agent's editable session](https://www.rightshold.com/answers/how-to-keep-an-agent-risk-approval-record-outside-the-agents-editable-session)

_Not legal advice. Updated 2026-11-07. JSON: https://www.rightshold.com/answers/how-to-run-a-break-glass-override-for-an-ai-agent-with-a-full-audit-trail.json_