Breakglass
Incidents
Control catalog Connecting…

The only things the agent is allowed to do

Each control is written and tested in advance, undoable in one step, and scoped to one asset. The agent can name one of these IDs; it can't write a rule or add an entry. Outcomes are counted every time a control is used: that record is what makes the next choice better.

ProblemAn agent that can write its own firewall rules can write a bad one.
SolutionA fixed catalog of reversible controls; the agent outputs an ID, never logic.
Why it mattersEvery possible change is reviewed before an incident, not during one.
How it's usedReview the catalog; outcome counts show which controls worked without breaking care.
Times applied
15
across every incident
Contained
11
exposure 0 and journey passed
Auto-reverted
2
exposure didn't fall or care broke
ControlKindScopeGuardsOutcomes
BG-CTL-PORTAL-DISABLE-MESSAGES
Turn off the optional "Message your care team" feature
Patients can't send a portal message until it's back on; booking, sign-in and records are untouched.
Turn off one optional feature
blast radius: low
Patient portal
portal.messages
reversibleno critical route
0✓ · 0↺ · 2 used
last used
BG-CTL-PORTAL-REQUIRE-SESSION-FOR-ACTIONS
Refuse server-action requests that carry no signed-in session
Signed-in patients notice nothing; anonymous requests to any server action, booking's included, are refused.
Active at the edge		Add one blocking rule
blast radius: low
Patient portal
portal.book, portal.messages, portal.billpay
reversibleno critical route
9✓ · 0↺ · 9 used
last used
BG-CTL-PORTAL-BLOCK-ACTIONS-EXCEPT-BOOKING
Block server-action requests except the booking action
Every server action on the portal is refused at the edge except booking.
Add one blocking rule
blast radius: medium
Patient portal
portal.messages, portal.billpay
reversibleno critical route
0✓ · 0↺ · 0 used
never used
BG-CTL-PORTAL-BLOCK-ALL-ACTIONS
Block every server-action request on the portal
Refuses every server action, booking included. The gate refuses it while the inventory is accurate.
Add one blocking rule
blast radius: high
Patient portal
portal.book, portal.messages, portal.billpay
reversibleTouches a critical route: gate refuses
0✓ · 2↺ · 2 used
last used
BG-CTL-PORTAL-ACTION-BODY-LIMIT
Cap request bodies on the messages route at 2 KB
Large message bodies are refused; ordinary messages still go through.
Tighten one setting
blast radius: low
Patient portal
portal.messages
reversibleno critical route
0✓ · 0↺ · 0 used
never used
BG-CTL-PORTAL-DISABLE-PREVIEW
Turn off document preview
Documents download instead of previewing in the browser.
Turn off one optional feature
blast radius: low
Patient portal
portal.preview
reversibleno critical route
0✓ · 0↺ · 0 used
never used
BG-CTL-PORTAL-SHUTDOWN
Take the whole patient portal offline
Nobody can book, sign in or read records. Needs a human.
Take the service offline
blast radius: critical
Patient portal
portal.signin, portal.home, portal.slots, portal.book, portal.records, portal.messages, portal.preview, portal.billpay
reversibleDenied to the agent
0✓ · 0↺ · 0 used
never used
BG-CTL-SUPPORT-DISABLE-SESSION-API
Turn off the help desk's session sign-in API
Agents sign in through the main page; the API sign-in path is closed.
Turn off one optional feature
blast radius: low
Patient help desk
support.session
reversibleno critical route
1✓ · 0↺ · 1 used
last used
BG-CTL-SUPPORT-DISABLE-ATTACHMENTS
Turn off ticket attachments
Patients can still open tickets, without attachments.
Turn off one optional feature
blast radius: low
Patient help desk
support.attach
reversibleno critical route
0✓ · 0↺ · 0 used
never used
BG-CTL-SUPPORT-SHUTDOWN
Take the help desk offline
No patient can open a ticket. Needs a human.
Take the service offline
blast radius: critical
Patient help desk
support.home, support.ticket, support.session, support.kb, support.attach
reversibleDenied to the agent
0✓ · 0↺ · 0 used
never used
BG-CTL-MAIL-DISABLE-HTML-PREVIEW
Turn off HTML message preview
Mail shows as plain text.
Turn off one optional feature
blast radius: low
Staff webmail
mail.preview
reversibleno critical route
0✓ · 0↺ · 0 used
never used
BG-CTL-MAIL-DISABLE-UPLOAD
Turn off the settings upload endpoint
Staff can't upload settings files; reading and sending mail still work.
Turn off one optional feature
blast radius: low
Staff webmail
mail.upload
reversibleno critical route
0✓ · 0↺ · 0 used
never used
BG-CTL-MAIL-SHUTDOWN
Take webmail offline
No staff email. Needs a human.
Take the service offline
blast radius: critical
Staff webmail
mail.login, mail.inbox, mail.preview, mail.upload
reversibleDenied to the agent
0✓ · 0↺ · 0 used
never used
BG-CTL-SITE-DISABLE-XMLRPC
Turn off XML-RPC
Remote publishing is off; the site and find-a-doctor still work.
Turn off one optional feature
blast radius: low
Public website
site.xmlrpc
reversibleno critical route
0✓ · 0↺ · 0 used
never used
BG-CTL-SITE-BLOCK-REMOTE-INCLUDE
Block PHP requests whose query string carries a URL
Requests that try to pass a remote address into the site's scripts are refused.
Add one blocking rule
blast radius: low
Public website
site.xmlrpc, site.comments, site.oembed
reversibleno critical route
0✓ · 0↺ · 0 used
never used
BG-CTL-SITE-DISABLE-OEMBED
Turn off oEmbed
Embedded previews of other sites stop working.
Turn off one optional feature
blast radius: low
Public website
site.oembed
reversibleno critical route
0✓ · 0↺ · 0 used
never used
BG-CTL-SITE-SHUTDOWN
Take the public website offline
Nobody can find a doctor online. Needs a human.
Take the service offline
blast radius: critical
Public website
site.home, site.doctors, site.xmlrpc, site.comments, site.oembed
reversibleDenied to the agent
0✓ · 0↺ · 0 used
never used
BG-CTL-VPN-BLOCK-PUBLIC-MGMT
Block the management interface from the internet
Admins manage the appliance from the inside network only.
Add one blocking rule
blast radius: low
Remote access gateway
vpn.mgmt
reversibleno critical route
1✓ · 0↺ · 1 used
last used
BG-CTL-VPN-DISABLE-ICA
Turn off the ICA proxy
Remote desktop sessions pause; staff remote sign-in still works.
Turn off one optional feature
blast radius: medium
Remote access gateway
vpn.ica
reversibleno critical route
0✓ · 0↺ · 0 used
never used
BG-CTL-VPN-SHUTDOWN
Take remote access offline
No remote access for on-call staff. Needs a human.
Take the service offline
blast radius: critical
Remote access gateway
vpn.signin, vpn.ica, vpn.mgmt
reversibleDenied to the agent
0✓ · 0↺ · 0 used
never used