---
title: "Keep tested break-glass accounts · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/identity-and-access/break-glass-access
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep tested break-glass accounts

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access)
- Rule: Keep two emergency admin accounts that work when single sign-on is down. Store their factors offline, alert on every use, and test them twice a year.
- How: An outage at the identity provider must not lock you out of production. Create two emergency users with long random passwords and hardware keys, kept in a safe or a sealed vault entry. Exclude them from automatic rules that could disable them. Every use pages the team and opens an incident. After each use or test, change the password.
- Check: The last test sign-in is less than 6 months old and raised the alert. Both accounts have hardware keys registered.

Example:

```text
Break-glass test, every March and September:
1. Two people open the sealed entry together.
2. Sign in to the sandbox account and list the users.
3. Confirm the page arrived, then sign out.
4. Set a new password, seal it, and log the date.
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/identity-and-access/break-glass-access`.

- Previous: [Lock the root account away](https://agentwranglers.se/playbook/infrastructure/identity-and-access/lock-root-account)
- Next: [Grant admin access for hours only](https://agentwranglers.se/playbook/infrastructure/identity-and-access/just-in-time-access)
- [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access)