# Break-glass

When a workspace requires SSO, a member gets in only with a recent SSO session through its connection. If your identity provider breaks, that would lock everyone out, so owners keep a way in.

## Who

Only owners, by the `sso.break_glass` permission: see [Roles](roles). An owner who signs in with GitHub or an emailed link still gets into the workspace. Admins, editors and viewers without an SSO session are turned away.

## How it's recorded

- Each owner who comes in this way is recorded as `sso.break_glass` in the [audit log](audit-log), once a day per person, with how they signed in.
- The SSO settings page lists the owners who came in without SSO lately, with a link to the audit log.
- Each member turned away is recorded as `sso.required`, the same way.

## What it doesn't touch

Requiring SSO guards the workspace's pages and actions for people. CI's project keys, agents' MCP keys and MCP sign-in tokens don't go through it, so pushes and agents keep working while your provider is down.

An invitation to a workspace that requires SSO is accepted only from an SSO session of its connection, whatever its role: break-glass is for people who already own the workspace.

## Where this comes from

- `app/enterprise/_lib/gate.ts`
- `app/enterprise/_lib/audit.ts`
- `app/workspace/_lib/access.ts`
- `app/workspace/_lib/permissions.ts`
- `app/workspace/[ws]/settings/sso/page.tsx`