Break-glass and audit

Crusoe AI Platform enforces strict administrative accountability through time-bound break-glass access and an append-only audit log.

1. Break-glass administrative access

Platform administrators hold no default access to customer project contents. In support or emergency scenarios, staff must initiate a break-glass grant.

Break-glass requirements

• Written Justification: Staff must provide a detailed reason string (minimum 8 characters) naming the support ticket.
• Time Limits: Grants automatically expire (default: 4 hours; maximum: 24 hours).
• IAM Visibility: Active break-glass grants appear on the project IAM page.
• Immutable Log Entry: Every grant records a project.break-glass event in the project audit log.

platformctl

Request break-glass access (platform admins only):

platformctl iam break-glass --project "$CAI_PROJECT" \
  --reason "Investigating support ticket OPS-142" --minutes 120

curl

curl -s -X POST "$CAI_API/v1/projects/$CAI_PROJECT/break-glass" \
  -H "Authorization: Bearer $CAI_TOKEN" \
  -d '{"reason":"Investigating support ticket OPS-142","minutes":120}'

Expected response:

{
  "grant": {
    "break_glass": true,
    "expires_at": "2026-08-12T14:00:00Z",
    "reason": "Investigating support ticket OPS-142"
  }
}

---

2. Project audit log

Every project maintains an append-only audit log recording administrative actions, membership changes, secret reveals, and credential management events.

Audit log entry structure

Field	Description
ts	Timestamp of event execution (UTC).
actor	Email identifier of user or service account; empty indicates system action.
action	Dotted event action string (e.g., project.secret.reveal).
target	Resource target modified by action.
detail	A JSON object, whose keys depend on the action. A secret reveal carries project, version, via and reason; a break-glass grant carries reason, role and expires_at; a service-account key creation carries service_account.

An export or SIEM pipeline has to decode detail as an object, not a string. via on a reveal says which path produced the plaintext: api for an explicit :reveal call, apply for a value read while applying a binding.

Querying audit logs

platformctl

platformctl audit --limit 20

curl

curl -s "$CAI_API/v1/projects/$CAI_PROJECT/audit?page_size=20" \
  -H "Authorization: Bearer $CAI_TOKEN"

Expected response:

{
  "entries": [
    {
      "ts": "2026-08-12T10:00:00Z",
      "actor": "admin@example.com",
      "action": "project.secret.reveal",
      "target": "openai-api-key",
      "detail": {
        "project": "acme",
        "version": 2,
        "via": "api",
        "reason": "verifying key rotation"
      }
    }
  ],
  "next_page_token": "cursor_12345"
}

Console UI

Open Security → Audit log in the Crusoe Console to search and filter project administrative events.

---

Key audited action categories

• Secrets: project.secret.write, project.secret.reveal, project.secret.delete, project.secret.apply, project.secret.bind.
• Credentials: apikey.create, apikey.revoke, serviceaccount.create, serviceaccount.key.create, serviceaccount.key.revoke.
• Membership: project.member.add, project.member.role, project.member.remove, project.break-glass.
• Gateway & Domains: mcpserver.create, project.crusoe-cloud.map.