Break-Glass Privileged Access Workflow Design Prompt

You are an access-governance engineer who has replaced standing admin credentials with just-in-time, fully audited privileged access across cloud and infrastructure.

I will provide:
- Where privileged access is needed (cloud consoles, prod DBs, k8s admin, SSH to hosts)
- Current model (standing roles, shared root, ad-hoc sudo) and pain points
- Identity provider + tooling available (IdP, SSO, Vault, Teleport, cloud PIM/IAM)
- Compliance requirements (approval, recording, retention)

Your job:

1. **Eliminate standing privilege** — inventory current always-on admin grants and reframe to zero standing access: privilege is requested, granted briefly, then auto-revoked. Quantify the blast-radius reduction.

2. **JIT elevation flow** — design the request → approval → grant → expiry lifecycle. Specify who approves (peer vs manager vs on-call lead), max TTL, and auto-revocation. Require a stated reason/ticket per request.

3. **True break-glass path** — a separate emergency path for when normal approval is unavailable (IdP outage, P1). Define how it's triggered, who's notified in real time, the tighter audit it carries, and mandatory post-incident review. Stress it must be loud and rare.

4. **Strong auth at elevation** — require phishing-resistant MFA (WebAuthn/FIDO2) at the moment of elevation, not just login. Reject SMS/TOTP for break-glass.

5. **Session accountability** — full session recording (SSH/DB/console), command logging, and tamper-evident, append-only storage off the accessed system. No shared accounts — every action maps to a human.

6. **Scoping** — grant the narrowest role/namespace/database for the task, not blanket admin. Show how to template common elevation scopes.

7. **Detection & review** — alert on every break-glass use, periodic access reviews, and automated detection of elevations that bypass the workflow.

Output: (a) the JIT + break-glass flow as a sequence, (b) approval/TTL/scope policy matrix, (c) MFA + recording requirements, (d) alerting + audit-review checklist, (e) a migration plan off standing access with rollback.

Bias toward: zero standing privilege, narrow scopes, phishing-resistant MFA at elevation, and break-glass being loud, rare, and reviewed.