Break-Glass Local With Remote Authority

Run locally while intentionally selecting remote credential configuration.

Scenario

Break-glass execution is for controlled operator workflows where a local process must inspect or derive remote-authority configuration without changing the host's runtime environment policy. The process can remain in Development while selecting CredentialAuthority.Remote.

Why this is allowed

Runtime environment controls host behavior. Credential authority controls credential branch selection. Keeping those decisions independent allows explicit local maintenance workflows without pretending the local process is a production host.

Operational guardrails

  • Require an explicit operator decision to select remote authority.
  • Keep audit output clear about the selected APB, environment, and credential authority.
  • Do not emit publishing profiles, secrets, or deployment credentials in diagnostics.
  • Prefer csaed validation before deriving or applying remote-authority payloads.

Related csaed flow

text 

csaed validate --apb <name> --env <environment> --target remote
csaed derive bootstrap-graph --apb <name> --env <environment> --target remote --out-file <path>