# LOC-005 Lab — Headless Admin CLI & Break-glass Control Record v1

Implement an evaluator for the eight synthetic fixtures. Keep the normal authorization path separate from emergency authorization, preserve expiry/revocation/stale/unbound states, and require command scope plus audit evidence.

The lab does not use real credentials, network access, operating-system privilege changes, or destructive effects. The transfer case restores the normal identity path and closes the emergency episode with post-event review.