Break-glass
When a workspace requires SSO, a member gets in only with a recent SSO session through its connection. If your identity provider breaks, that would lock everyone out, so owners keep a way in.
Who
Only owners, by the sso.break_glass permission: see Roles. An owner who signs in with GitHub or an emailed link still gets into the workspace. Admins, editors and viewers without an SSO session are turned away.
How it's recorded
- Each owner who comes in this way is recorded as
sso.break_glassin the audit log, once a day per person, with how they signed in. - The SSO settings page lists the owners who came in without SSO lately, with a link to the audit log.
- Each member turned away is recorded as
sso.required, the same way.
What it doesn't touch
Requiring SSO guards the workspace's pages and actions for people. CI's project keys, agents' MCP keys and MCP sign-in tokens don't go through it, so pushes and agents keep working while your provider is down.
An invitation to a workspace that requires SSO is accepted only from an SSO session of its connection, whatever its role: break-glass is for people who already own the workspace.
Where this comes from
app/enterprise/_lib/gate.tsapp/enterprise/_lib/audit.tsapp/workspace/_lib/access.tsapp/workspace/_lib/permissions.tsapp/workspace/[ws]/settings/sso/page.tsx