Circuit breaker: stop on breach

The circuit breaker is a process-external master switch: once tripped, session prompt, trigger dispatch, and similar execution paths fail at an entry assertion — they do not rely on each business branch remembering to check. State is reversible and written to audit.

State and APIs

A single global row holds state: whether tripped, reason, and operator.

API	Who	Effect
GET /breaker	Readable by all roles	Query current state
POST /breaker/trip	admin only	Body includes reason; trip the breaker
POST /breaker/reset	admin only	Clear the trip

stateDiagram-v2
  [*] --> Armed: normal
  Armed --> Tripped: trip
  Tripped --> Armed: reset

How it takes effect

Execution paths call an assertion: if tripped, throw; HTTP surfaces roughly as 503. Triggers assert before firing so scheduled and event work cannot keep creating sessions during a trip. Audit events: breaker.trip / breaker.reset.

The breaker does not replace fine-grained permission or HITL; it answers the operational case “stop everything now.” Fine-grained control remains RBAC and HITL.

---

Related reading:

• RBAC and permission layers
• Trigger component chain
• Identity and tenant binding