Agentic AI Security
Break glass is part of governance,
not a way around it.
A governance layer that only blocks eventually gets disabled. When output is withheld, a person can request a reviewed override with a documented reason — and that decision becomes part of the same immutable record.
The Problem
Systems with no exception path get switched off
Every enforcement layer eventually blocks something it should not have. A rule tuned for a common case meets an uncommon but legitimate one, and correct work is refused.
If the only available response is to lose the work, pressure builds to weaken the rule or disable the layer entirely. The governance system is then defeated not by an attacker but by the people it was built to serve.
A designed exception path resolves that. The block holds, the work is preserved, and a human with authority decides. The system stays strict because there is a legitimate way through it.
The Lifecycle
Request, review, record
Request
A blocked result can be escalated with a written reason. The request is stored pending, preserving the full violation detail and the blocked output so the reviewer sees exactly what was withheld.
Review
An admin approves or denies. Reviewer identity and notes are captured alongside the decision.
Record
The decision writes its own audit row — override-approved or override-denied — carrying the escalation ID. The exception is as traceable as the block that caused it.
States
Pending, approved, denied, or expired. A pending-review queue lists outstanding requests oldest-first so nothing quietly ages out unseen.
The Property
The override is on the record
This is the difference between an exception process and a bypass. A bypass leaves no trace and cannot be reviewed. An exception is evidence.
Because approvals and denials are written to the same ledger as the calls themselves, override activity is auditable in the same query. A reviewer approving too readily is visible. A rule generating constant escalations is visible, and is a signal that the rule needs tuning rather than that users need discipline.
It also means the answer to a regulator asking whether controls were ever overridden is not a matter of recollection. It is a filter.
By Design
Routing high-stakes actions to a person
Escalation handles the unexpected block. Separately, some actions should require human judgement every time by configuration rather than by exception.
Workspaces can be configured so that consequential operations route through approval before execution, independent of whether any rule was triggered. Least-privilege tool gating and approval routing work together: the model cannot reach a tool it was not granted, and some granted tools still require a person to say yes.
Strict enforcement with a legitimate way through
See how break-glass escalation keeps governance strict by making exceptions reviewable instead of invisible.