> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Break-glass access

> Let named responders grant themselves access in an emergency.

Break-glass access lets a named responder approve their own [access request](https://infisical.com/docs/documentation/platform/pam/access-requests/overview.md) when no approver is available, such as during an incident. Infisical notifies every approver that the responder skipped.

Break-glass access doesn't give anyone permanent access. The responder still files a request with a reason, and still gets access only for the duration they requested. The only difference is that no approver approves the request.

## Set up break-glass access

A responder can only use break-glass access if two settings are turned on, and a different admin owns each one:

* **On the account template:** A Product Admin turns on **Allow Break-Glass**, which decides which accounts allow break-glass access
* **On the folder:** An Admin of the folder adds responders under **Break-Glass Users**, which decides who can use break-glass access

If either setting is off, nobody can use break-glass access on the account.

Before you start, [set up approval](https://infisical.com/docs/documentation/platform/pam/access-requests/overview.md#set-up-approval) on the account. The template must have **Require Approval** turned on, and the folder must have at least one approver.

**Step 1**

As a [Product Admin](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md#product-membership), go to **Privileged Access Management** > **Account Templates**, open the template, and turn on **Allow Break-Glass**.

**Step 2**

As an Admin of the folder, open the folder's **Approvals** tab and add users or groups under **Break-Glass Users**.

**Step 3**

Select **Save Changes**.

Break-glass users must already be members of the folder. Only users and groups can be break-glass users, so a machine identity or an [AI agent](https://infisical.com/docs/documentation/platform/pam/ai-agents/overview.md) can't use break-glass access.

> [!TIP]
>
> Add only your on-call responders as break-glass users, not everyone who uses the folder's accounts.

## Use break-glass access

Break-glass access needs a reason of at least 10 characters that explains why the request can't wait for an approver. Infisical sends the reason to the approvers you skip and records it in the audit log.

You can use break-glass access when you file a request, or later while the request is pending.

**When you file the request**

**Step 1**

On the **Accounts** page, select the key icon on the account's row.

**Step 2**

Turn on **Break glass**, then enter the **Reason** and the duration.

**Step 3**

Select **Break glass**.

**While the request is pending**

**Step 1**

On the **Accounts** page, select the clock icon on the account's row.

**Step 2**

Under **Break glass**, enter the **Reason** and select **Break glass**.

You get the access that the request asked for. If you used break-glass access on a session request, you can launch sessions, and if you used it on a credential request, you can view the credential. The access expires at the end of the requested duration, an Admin of the folder can [revoke it](https://infisical.com/docs/documentation/platform/pam/access-requests/overview.md#revoke-access), and Infisical records your sessions like any other session.

## What Infisical records

Each time someone uses break-glass access, Infisical does the following:

* Emails each approver who was skipped, with the reason
* Notifies the skipped approvers in Infisical
* Sends the folder's **Break-Glass Used** [alert](https://infisical.com/docs/documentation/platform/pam/access-requests/overview.md#alerts), if the folder has one
* Adds a **PAM Access Policy Bypassed** event to the [audit log](https://infisical.com/docs/documentation/platform/pam/auditing.md) with the reason, the account, the folder, and the number of approvers skipped
* Shows a **Break-glass** badge on the request in the folder's **Access Requests** list

To review every use of break-glass access, filter the audit log for **PAM Access Policy Bypassed**.

## Frequently asked questions

> **Can I use break-glass access on someone else's request?**
>
> No. Break-glass access only approves your own pending request.

> **What happens if I'm removed from the folder while my request is pending?**
>
> If you're removed from the folder or from its **Break-Glass Users**, you can't use break-glass access on the request.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.