Break-Glass Mechanisms Summary Three independent halt mechanisms: in-application stop button (prominent UI control, ), infrastructure kill switch (dedicated API endpoint independent of application, ), and feature flag pattern (LaunchDarkly/Unleash, sub-200ms propagation, ). Any Level 2+ person can trigger. Non-retaliation for good-faith activations. Annual testing exercise required. See for detailed treatment. Key outputs

• Three independent halt mechanisms
• Level 2+ authorisation
• Annual testing and non-retaliation