The break-glass door that depends on nothing

Access stacks fail closed. The identity provider has an outage, and suddenly the SSO-gated dashboard, the mesh ACLs, and the bastion that authenticates against it are all sealed: during exactly the incident you need them for.

Keep one door that depends on none of it. A terminal URL behind a password group: Basic Auth, checked by the proxy on your own server, with no identity provider, no VPN concentrator, and no corporate network in the loop. The URL and the credentials live in the on-call vault and rotate like any break-glass secret.

Most days, nobody touches it. On the bad day, it is a browser tab that still opens.

Break-glass is a door that depends on nothing else being up.