Answer
Provide a tightly controlled admin path (a local admin account or a rarely-used group binding) whose use is logged and alerted, with credentials stored securely and rotated after use. It grants elevated access during incidents when SSO/normal roles are insufficient, while keeping the action auditable.
Real-world example During an SSO outage, an on-call lead uses a monitored break-glass account to restore service, triggering an audit alert.