Skip to content

Break-glass procedure

Status: Draft, pre-formation. Adopted by board motion at or shortly after incorporation; reviewed annually thereafter.

Purpose: Restore administrative control of the Guild's digital systems when the primary sysadmin (the Administrator) is unavailable, incapacitated, or has departed without a planned handover.

Owner of this procedure: The Board Chair, with the Secondary administrator (Treasurer or Vice Chair, as named in the systems inventory) responsible for execution.

Plain English: This is the emergency exit. Nobody hopes to use it, but it exists so that the Guild keeps running if the person who normally administers things stops being able to do so. It is not a workaround for normal disagreements about technology, access, or policy — those go through the board the regular way.

When break-glass applies

The procedure may be invoked only when all of the following are true:

  1. The primary sysadmin (Administrator) is unreachable, incapacitated, deceased, has resigned without a planned handover, or has been suspended or removed by board action
  2. There is an operational need that cannot wait for the primary sysadmin to become reachable (a specific system change, a renewal, a security incident, or a board-directed action)
  3. The Board Chair (or Vice Chair, if the Chair is the primary sysadmin's relative or otherwise conflicted) has authorized invocation in writing

Disagreements with the sysadmin's day-to-day technical decisions are not a break-glass condition. The remedy for those is the regular committee and board process.

Roles

Role Filled by Authority in break-glass
Primary sysadmin Administrator The role being recovered. Has no special authority during break-glass; their access is revoked or rotated.
Secondary administrator Named in systems inventory — typically Treasurer or Vice Chair, must not be the same person as the primary Executes recovery steps
Authorizing officer Board Chair (or Vice Chair if Chair conflicted) Authorizes invocation in writing; logs use within 24 hours
Witness A second director who is not the secondary administrator Observes envelope opening and credential rotation
Recovery contact Registered agent, or a board-approved external party Holds the sealed emergency credential envelope; releases it only on presentation of written authorization

No fewer than three people are involved in any break-glass invocation: the authorizing officer, the secondary administrator (executing), and the witness. This is the same separation-of-duties principle that applies elsewhere in governance.

The emergency credential envelope

A physical, tamper-evident envelope or sealed safe containing the minimum credentials needed to recover administrative control:

  • Account-recovery codes for the Guild's password manager
  • Account-recovery codes for the Guild's email identity (Google Workspace)
  • Account-recovery codes for the domain registrar
  • A printed copy of the current systems inventory
  • A signed statement from the primary sysadmin and the Board Chair attesting that the contents were verified and sealed on a specific date

Storage. The envelope is held by the registered agent or in a board-approved physical safe. It is never stored at the sysadmin's home, office, or personal possession.

Refresh. The envelope is refreshed annually at the January governance review, or within 30 days of any of the following:

  • Change of primary sysadmin
  • Change of secondary administrator
  • Change of registered agent
  • Change of password-manager master account
  • Change of Google Workspace super-admin
  • Change of domain registrar account

Verification. Each refresh is recorded in the board minutes with the date, the people present, and a confirmation that the prior envelope was destroyed.

Read-only access during refresh. When the envelope is opened for refresh (not for recovery), the seal is replaced with a new tamper-evident seal and the contents are not photographed or transcribed digitally beyond the refresh log entry.

The procedure

Step 1 — Confirm the trigger condition

The Board Chair (or Vice Chair if conflicted) confirms in writing that one of the trigger conditions in When break-glass applies is met. This confirmation:

  • Names the trigger condition specifically
  • Identifies the operational need that cannot wait
  • Names the secondary administrator who will execute and the witness who will observe
  • Is dated and signed (electronic signature acceptable)
  • Is filed with the Secretary within 24 hours of invocation

Step 2 — Retrieve the envelope

The secondary administrator and the witness travel together to the registered agent or the safe. The recovery contact verifies the written authorization and releases the envelope. The seal is checked for tamper evidence; any anomaly is photographed and reported to the Board Chair before the envelope is opened.

Step 3 — Open and use only what is needed

The envelope is opened in the presence of the secondary administrator and the witness. Only the credentials needed for the specific operational need in Step 1 are used. Other credentials in the envelope are not read aloud, transcribed, or photographed.

Step 4 — Rotate credentials

Within 24 hours of any break-glass use, every credential that was exposed during the procedure is rotated:

  • Master passwords
  • Recovery codes
  • Recovery email addresses (if the previous one was personal-tied)
  • Any API keys, application passwords, or tokens that were viewed

The rotation is performed by the secondary administrator. New credentials are sealed in a refreshed emergency envelope per the Refresh rules above.

Step 5 — Document

A break-glass log entry is filed in the board's secure document store with:

  • The date and time of invocation
  • The trigger condition
  • The authorizing officer, secondary administrator, and witness
  • The systems accessed and the actions taken
  • The date credentials were rotated and the new envelope was sealed
  • A board agenda item for the next regular meeting reporting the use

The log entry is never stored in this repository.

Step 6 — Address the underlying cause

If break-glass was invoked because the sysadmin is permanently unavailable (departure, incapacitation, removal), the board:

  1. Names an interim sysadmin within 14 days
  2. Brings forward the next quarterly access review to the interim's start date
  3. Treats the situation as a planned handover from that point forward, following the administrator handover plan

If break-glass was invoked for a temporary unavailability, the primary sysadmin is briefed on what occurred when they return and the post-rotation credentials are transferred back through the password manager — never through email, chat, or any non-vault channel.

Annual tabletop drill

Once per year, at the January governance review, the secondary administrator and the witness conduct a tabletop drill of this procedure without opening the envelope. The drill:

  • Walks through Steps 1–6 against a hypothetical trigger
  • Verifies the recovery contact is reachable
  • Verifies the envelope's location and refresh date
  • Identifies any gaps (e.g., a system added since the last refresh that is not in the envelope)

The drill is recorded in the board minutes. A real break-glass invocation in a given year satisfies the drill requirement for that year.

What this procedure does not do

  • It does not override the board's authority to direct the sysadmin under normal circumstances
  • It does not create a parallel administrative track that bypasses the committee structure or the conflict-of-interest policy
  • It does not authorize the secondary administrator to make policy or financial decisions; it authorizes only technical recovery actions tied to the specific operational need

Cross-references