Break the Glass Medical Term
The break the glass medical term describes an emergency workflow that grants fast system access. You set it up by creating temporary roles that bypass normal rules during a crisis. Health IT teams build these paths so doctors can treat patients without waiting. In software teams, engineers use the same method to fix broken apps during an outage. If teams make these emergency roles too broad, users gain full control over every table. That creates a major security risk once the crisis ends. How
Break-Glass Access Procedures: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
The break the glass medical term describes an emergency workflow that grants fast system access. You set it up by creating temporary roles that bypass normal rules during a crisis. Health IT teams build these paths so doctors can treat patients without waiting. In software teams, engineers use the same method to fix broken apps during an outage. If teams make these emergency roles too broad, users gain full control over every table. That creates a major security risk once the crisis ends.
How the break the glass medical term works in practice
In a hospital, a doctor normally reads only their own patient files. When an emergency happens, a different doctor might need those files right away. The doctor triggers a special prompt in the health app to override the block. The system asks for a reason and then opens the record. At the same time, the system sends an alert to the security team.
Cloud and database teams copy this exact pattern for production systems. Normally, an engineer cannot log in to the main patient database directly. When an app crashes at night, the on-call engineer triggers an emergency role. Identity tools grant a temporary role that lasts for one or two hours. The engineer logs in, fixes the bug, and the role expires on its own. Security staff review the ticket the next morning to check the reason.
What native emergency roles solve and what they miss
Native emergency roles solve the speed problem during a life-or-death event or outage. Nobody wants a doctor or an engineer locked out when seconds count. Identity systems handle the login step well and track who asked for the role. They also revoke the role when the timer runs out.
Still, this setup leaves a wide gap while the session is active. Standard identity tools only decide who can log in to the database or server. They cannot check what individual queries or commands do in flight. Once an engineer breaks the glass, they hold full admin rights on that database. A single bad query can delete a table or expose thousands of rows.
Native database roles also return raw data for every query during an emergency session. An engineer fixing a broken index does not need to read personal data. Yet a broad emergency role returns real emails, phone numbers, card numbers, and national IDs. Reviewing an alert the next day cannot undo a leaked file or dropped table. Teams need controls that inspect each command and rewrite matched fields in results.
Break-Glass Access Procedures: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
How to tighten emergency workflows for technical teams
Start by splitting one giant admin role into smaller task roles. Create one role for reading logs and another for restarting services. Require a short text reason before any user activates an elevated role. Route every activation alert to a shared chat channel so peers see it right away.
Next, move away from broad server logins and focus on the command level. Instead of opening a whole database, require approval for specific high-risk queries. Add data masking so queries rewrite emails and national IDs in the output. This lets engineers fix the broken system while keeping sensitive records safe.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
Where did the break the glass medical term originate?
The phrase comes from red fire alarm boxes on walls. You had to break a small glass pane to pull the lever. Hospitals adopted the phrase for overriding digital locks on patient charts during emergencies.
How do auditors check emergency access logs?
Auditors match every emergency role activation against an incident ticket or patient chart. They check who triggered the role, why they needed it, and what commands ran. Missing command logs often cause an audit failure.
Why are static emergency passwords dangerous?
Shared passwords written in a safe do not tie actions to one person. If someone leaks data using a shared account, you cannot prove who did it. Modern teams tie every emergency action to an individual user identity.