Some incidents need direct database access — the per-service credentials are unavailable or suspect, and you need to read or repair application state now. For exactly that, goca provisions goca_breakglass: a role that holds, by membership, the union of the live service roles' grants. Application-equivalent, deliberately not owner-equivalent — it cannot run DDL and cannot touch the migrations table, so it can repair state but not reshape the schema.
In steady state it is NOLOGIN. Enabling it is one statement with the owner credential:
ALTER ROLE goca_breakglass LOGIN PASSWORD '<one-time value>'; -- work the incident, then: ALTER ROLE goca_breakglass NOLOGIN;
Record the enable and the disable in your incident log — PostgreSQL keeps no audit trail for role changes, which is exactly why the role stays NOLOGIN when nobody is using it. The pattern to notice: like break-glass MFA cards, this is a pre-provisioned emergency path whose existence is safe and whose use is an event. The alternative — inventing access during the incident — is how emergency access becomes standing access.
Now I can grant myself emergency database access and take it back.