Break-Glass Emergency Authorization Bypass with Mandatory Audit

affected records carry an immutable break_glass=true marker + actor + reason + timestamp

then the action executes, the record carries immutable break_glass=true + actor + reason + timestamp, a high-priority audit event is emitted synchronously, a post-review task is created, and the break-glass session auto-expires

negative) when invoked without MFA step-up or without justification text then 403 with error code break_glass_auth_required.

break-glass is opt-in, role-gated, and requires step-up re-authentication (MFA) + mandatory free-text justification;
scope limited to a single named action, not a standing mode;
affected records carry an immutable break_glass=true marker + actor + reason + timestamp;
high-priority audit event emitted synchronously and cannot be suppressed;
mandatory post-event review task created and tracked to closure;
time-boxed with auto-expiry;
segregation-of-duties: the invoker cannot also close their own review;
fail-closed if audit logging is unavailable (no silent bypass).

Given a pre-authorized admin role, a single named approval-blocked action, and a valid MFA step-up;
when the admin invokes break-glass with a mandatory justification text;
then the action executes, the record carries immutable break_glass=true + actor + reason + timestamp, a high-priority audit event is emitted synchronously, a post-review task is created, and the break-glass session auto-expires;
(negative) when invoked without MFA step-up or without justification text then 403 with error code break_glass_auth_required.

break_glass_event { id: string, actor_id: string, action: string, scoped_record_id: string, justification: string, mfa_verified_at: timestamp, expires_at: timestamp, review_task_id: string, created_at: timestamp, external_id: string };
immutable after creation;
references audit_log, review_task;
(reference, product may differ).

POST /v1/break-glass/invoke { action, scoped_record_id, justification, mfa_token } -> 201 { id, expires_at, review_task_id };
GET /v1/break-glass/{id};
emits break_glass.invoked high-priority event synchronously;
fails with 503 if audit logging unavailable.

INVOKED -> ACTIVE -> EXPIRED;
terminal EXPIRED or REVIEWED;
guard: ACTIVE auto-transitions to EXPIRED at expires_at;
invoker cannot close their own review task;
audit event emission failure blocks the action.