Break-Glass Emergency Access

Break-glass accounts hold sealed emergency credentials that require an N-of-M quorum of designated approvers to unseal. Each unseal request is tracked as a first-class audit event, broadcast to the compliance event topic, and delivered to the configured SIEM for real-time alerting. SHA-256 unseal codes are issued to each approver individually -- the credential is only revealed when enough codes are combined.

Unsealed accounts auto-reseal after a configurable TTL so emergency access cannot be left open. The full lifecycle (seal, unseal request, vote, reveal, reseal) is captured in a hash-chained audit record suitable for SOC 2, HIPAA, and PCI-DSS evidence.

Key Configuration

• Required approver count (N-of-M quorum)
• Auto-reseal TTL (hours)
• SIEM alert destination
• Approver rotation policy