For Divvent’s own team. It is generated from the operations document in our repository, which is the one to edit. If you use Divvent, the help centre is for you.
4. Break-glass
The capability that reaches furthest, so it lives behind the identity that is hardest to obtain. Console only, never the portal, and there is no function in the portal's Worker that could reach it.
| # | Who | Action |
|---|---|---|
| 1 | Operator A | Console → Break-glass → request: application, reason, scope — within ten minutes of signing in to the console (§6f) |
| 2 | Operator B | Console → Break-glass → approve — also within ten minutes of signing in |
| 3 | Operator A | Console → Support → read, under the grant |
| 4 | Whoever | Tell the customer, then record it |
Every link refuses to be skipped.
- No second factor, no grant — and the second factor is proven by Access, not declared by the requester. There is no checkbox. The request, and the approval, are each refused unless that operator's verified Access assertion was issued in the last ten minutes (
BREAK_GLASS_FRESH_MS), which, with the console application requiring MFA on every sign-in, means they presented a second factor minutes ago. It only means that if §6f is done; without it, a fresh sign-in is a fresh Google sign-in and nothing more. The screen says how long ago you signed in; if it is too long, open/cdn-cgi/access/logouton the console, sign in again, and ask. - A reason under ten characters is refused. The audit row is read by a customer asking why their data was opened; "debugging" is not an answer to that.
- No scope, no grant — a grant with an implicit scope grants everything. Name the operations from:
health,runtime,deployment,migration,resources. There is no operation that takes a query, which is how "neverSELECT *" is meant rather than merely written down. - The requester cannot approve their own. Approving your own is a one-person rule wearing a two-person rule's clothes.
- It expires by the clock at every use. Four hours by default, eight at most, set in the console. Nothing sweeps it — a sweeper is a thing that can be down while a grant is live.
Every read under a grant is audited before the read, so a read that throws halfway is still a read somebody did.
The customer notification is a send, on approval, to every owner of the account (DESIGN.md §10), and the grant records when it was delivered. unnotified() lists every grant whose send reached nobody; tell them another way, then Record that the customer was told.