Break-glass credentials

A Tenvyr break-glass credential is a separately governed SSH public key. It is not usable merely because it has been enrolled: a different owner or administrator must verify it for a bounded period.

Establish a credential

1. Generate the emergency key in the approved hardware or vault.
2. Keep the private key outside Tenvyr.
3. Enroll the public key as credential kind break_glass through approved administrative tooling.
4. Record its fingerprint, custodian, storage location, and recovery procedure.
5. Have a different owner or administrator perform verification.

The credential owner cannot verify their own key.

Independent verification

The verifier must:

1. compare the full public key and fingerprint with the independent source;
2. create and consume a fresh two-minute SSHSIG proof challenge;
3. attach an evidence reference;
4. choose a validity window from one hour through 90 days; and
5. complete built-in MFA within five minutes.

Verification is exposed through the versioned control-plane API. The current console provides tenant-wide inventory and evidence but does not fabricate a verification ceremony without the signed challenge.

Make it usable

Create a policy with credential mode Verified break-glass. The agent publishes the key only while all of these remain true:

• the credential is enabled;
• independent verification exists;
• the verification window has started and not expired;
• the policy and grant remain active; and
• the host group permits the resulting access.

Static-key reconciliation is bounded by the verification expiry even if a grant would otherwise last longer.

Review

In Credentials → Break-glass status, check:

• credential owner and full fingerprint;
• verification status and timestamp;
• independent verifier;
• expiry; and
• evidence reference.

Schedule a drill before expiry. A drill should prove retrieval, a real connection, evidence capture, removal after expiry, and restoration of normal access.

Compromise or retirement

Contain the credential immediately. Tenvyr disables future use, revokes related grants and certificates, and publishes updated desired state. Then remove or destroy the private key according to the custodian's procedure and preserve the incident evidence.