Emergency access

When an agent misbehaves or a credential may have leaked, the Emergency access page gives you three controls. Every action is recorded and emailed to everyone on the account.

Lockdown

Freeze all agents makes every broker refuse every agent operation, including approved requests and published endpoints. Brokers apply it within about 5 seconds. Nothing overrides it. Ending it requires typing UNFREEZE. Agents only see the reason lockdown, never your note.

Revoke all agent tokens

Invalidates every 90-day agent token at once. Connected brokers stop accepting them within one poll. Workload identity tokens are unaffected.

Access grants

A grant lets one agent perform specific actions on one named resource that its policy denies or holds for approval, for 15 minutes, 1 hour or 4 hours. A reason is required and it can be revoked at any time. Grants never override account guardrails or a lockdown, calls under them are audited with reason break_glass, and any credential minted under a grant expires before the grant does.

Two-person rule. Turn on Require a second approver on the Emergency access page, and a grant one user creates stays inert until a different user on the account approves it. Brokers only enforce approved (active) grants. The approval clock starts when the grant is approved, so a grant that waited still lasts its full window. Lockdown and token revocation are unaffected.

Risk-based review

A broker started with BROKER_RISK_REVIEW=1 scores every policy-allowed operation by blast radius (destructive vs mutating vs read, and wildcard resources) and novelty (an agent/provider/resource/action tuple the broker has not seen before). An operation whose score meets the threshold (BROKER_RISK_THRESHOLD, default 60) is held for human approval with audit reason risk_review, exactly like a rule that requires approval. It only adds friction: it never turns a denial into an allow, and never second-guesses a break-glass grant.

Local kill switch

Freeze a single broker on its own host, with no connection to PastKeys needed:

export BROKER_LOCKDOWN_FILE=/var/lib/pastkeys/lockdown
./pastkeys lockdown on
./pastkeys lockdown status
./pastkeys lockdown off

The broker must run with the same BROKER_LOCKDOWN_FILE; it refuses every operation while the file exists.