Authority Break-Glass Account Runbook

Audience: Stella Ops platform operators and security/incident responders.

Status: not implemented

Verified against src/Authority on 2026-07-31. Authority does not ship a break-glass login, session manager, HTTP endpoint, CLI command, Console surface, or break-glass audit stream. The unregistered BreakGlassSessionManager design was removed in Sprint 20260731_003 so it cannot be mistaken for an available incident-recovery mechanism.

Do not treat the local-policy YAML/JSON models as an emergency login path. Some file parsing and fallback-policy source remains under LocalPolicy/, but it is not registered as an operator-usable Authority break-glass workflow.

What operators can use

• Follow the installation owner’s out-of-band Authority recovery procedure for identity-provider or database outages. Stella Ops does not currently provide a product break-glass account for this scenario.
• Release Orchestrator gate exceptions are a separate feature. When configured, they require the dedicated scope, fresh authentication, an enrolled operator signing key, a signed decision envelope, justification, risk acknowledgement, and expiry. They do not restore access to an unavailable Authority service.
• If the operator-signing client or issuer is not configured, the gate-exception endpoint returns 503 operator_decision_signing_not_configured and names the required settings. It never falls back to an unsigned decision.

Safety invariant

No supported flag or local credential bypasses normal Authority authentication. A future emergency-access implementation requires an explicit architecture and threat-model decision, runtime registration, durable audit, expiry enforcement, operator documentation, and a real end-to-end forcing test before this runbook can describe an actionable procedure.

Related material

• docs/modules/authority/architecture.md
• docs/modules/release-orchestrator/architecture.md
• docs-archive/implplan/SPRINT_20260731_003_ReleaseOrchestrator_gate_operability.md