Emergency Policy Override Mechanisms

Sometimes a legitimate action is blocked by policy and the normal exception process is too slow. A customer is locked out, a critical system needs a manual fix, or an incident requires actions that policy does not anticipate. Emergency override mechanisms (break-glass procedures) allow authorized personnel to bypass policy temporarily, with full accountability.

Design Principles

Emergency overrides must be auditable, time-limited, and narrowly scoped. An override that gives unrestricted access with no logging defeats the purpose of having policies in the first place.

Override Levels

Define graduated override levels based on the severity of the situation:

Level 1: Extend an existing permission temporarily. For example, increase a rate limit for 30 minutes. Requires one authorized approver.

Level 2: Allow a normally denied action for a specific resource. For example, permit write access to a restricted table. Requires two authorized approvers.

Level 3: Suspend policy evaluation entirely for a specific agent. Requires executive approval and triggers immediate incident review.

override:
  level: 2
  action: "db.write"
  resource: "restricted_table"
  duration: "1h"
  approved_by: ["admin-1", "admin-2"]
  reason: "INC-4521: customer data correction"

Audit Trail

Every override produces a permanent, immutable audit record. The record includes who requested the override, who approved it, what actions were taken during the override window, and when the override expired. Authensor's receipt chain captures override events with the same tamper-evident guarantees as normal action receipts.

Automatic Expiration

Overrides must expire automatically. Never rely on a human to remember to revoke an emergency override. Set the duration at the time of approval and enforce it in the policy engine. When the override expires, normal policy evaluation resumes.

Post-Incident Review

After every emergency override, conduct a review. Determine whether the override was necessary, whether the normal policy should be updated to handle the situation, and whether the override scope was appropriate. Feed findings back into policy improvement.

Emergency overrides are a safety valve, not a workaround. If overrides happen frequently, the policy needs fixing.