A deliberate exception, not a bypass
A break-glass procedure grants emergency access that skips some portion of normal approval friction — multi-party sign-off, a scheduled request window, a narrower scope — so that someone can act immediately during an incident where the standard process would cost time the situation doesn't have. The point isn't to remove the control; it's to substitute a different, faster control appropriate to an emergency.
What makes it a procedure rather than a loophole is what happens around the access grant: the exception is narrowly scoped, time-limited, and — critically — logged and reviewed after the fact specifically because it bypassed the usual checks. An emergency account that grants broad access and is never revisited afterward isn't a break-glass control; it's just a permanent backdoor with an emergency-sounding name.
The review after is what keeps it honest
Because break-glass access is, by design, used without the normal preemptive checks, the compensating control has to happen afterward: every use gets reviewed, with an explanation of what justified it and confirmation that the access was actually needed for what happened. A break-glass path that's used routinely rather than rarely is a sign the normal process is too slow for legitimate cases, not that the exception is working as intended.