The 3 a.m. Test: Access Control That Survives an Emergency

The scenario the design has to survive

An emergency operations centre activates at 02:58. Within an hour there are people on the floor who do not normally hold administrative access to the systems they now need: mutual-aid staff from a neighbouring county, a vendor engineer brought in for a failing radio gateway, an analyst pulled from a different department. Every one of them has a legitimate reason to be there and no entry in your entitlement register.

What happens next determines whether your access control is real. In most organisations, somebody with the authority to do it turns something off — shares an account, disables MFA on a system, hands over a break-glass password, or opens a firewall rule — and it stays that way well past stand-down.

The quiet failure. Post-incident reviews rarely record the access decisions made at 3 a.m. The bypass built during the event becomes the permanent configuration, and the next assessment finds it two years later with nobody able to say who opened it.

What surge access actually requires

Grant in seconds, not tickets. If the fast path is slower than the workaround, the workaround wins. Authorisation has to be something a duty supervisor can issue immediately from the console.
Scoped to the activation. Access to the systems this event needs, as the account this role uses — not a general administrative grant because it was quicker to select.
Expiring by construction. The grant carries its own clock and ends at stand-down whether or not anyone remembers. Cleanup that depends on someone filing a removal request after a 72-hour activation does not happen.
Recorded like everything else. Surge sessions are the ones most likely to be reviewed afterwards, so they are the last ones that should be exempt from recording.
Attributable to a person. Mutual-aid staff get named accounts, even temporary ones. "The county sent four people and one of them did it" is not an answer anyone can use later.

Break-glass is the exception, not the plan

Every mission network needs a documented path around the normal control for the case where the control itself is what failed. That path should be sealed, alarmed on retrieval, single-use, rotated afterwards, and reviewed in writing. What it should not be is the mechanism people reach for whenever the normal path is inconvenient — and the way to prevent that is to make the normal path fast enough that nobody wants the sealed envelope.

The stand-down that matters more than the activation

Activations end in exhaustion. Nobody wants to spend the morning after a 72-hour event reconciling who still has access to what. Time-boxed grants turn that from a task into a property: at stand-down the surge authorisations expire on their own clock, and the report of what was granted, used, and revoked is generated from the same data that enforced it rather than reconstructed by hand.

What good looks like the next morning. One report showing every temporary grant issued during the activation, who approved it, what was reached, what was recorded, and the timestamp each grant expired — with nothing still open.

Designing for the worst night, not the average day

Access control that assumes calm conditions is a control that is optional exactly when it matters. The design goal is narrower and harder: nobody on the floor at 3 a.m. should ever have a reason to switch it off.