Comparison
Break-glass accessvsJust-in-time access
Break-glass access
there is a sealed credential that bypasses every control, its use pages three people, and it has been used twice.
A deliberately preserved emergency path to full access for when the normal ones fail — the identity provider is down, the automation is broken, the on-call cannot get in. It has to exist, because a control with no override becomes an outage of its own, and it must be loud: heavily audited, alerting on use, and rotated afterwards. It also needs testing, since an emergency path that depends on the system that is down is not one.
Full entry →Just-in-time access
nobody holds production access by default; you request it, state why, and it expires by itself in an hour.
Granting elevated permissions temporarily on request rather than holding them permanently. It shrinks the standing blast radius of any compromised account to almost nothing and produces a record of who needed what and why. It only works if the request path is fast, since anything that adds minutes during an incident gets replaced by a permanent grant someone made 'temporarily'.
Full entry →