A service team needs emergency privileged access during outages. What is the best design?

1. Unlogged access whenever someone claims urgency
2. Controlled emergency access with logging, limited duration, and post-use review
3. A prohibition that prevents every recovery action
4. A shared permanent administrator password in a public document