# Playbook: Loss of Admin Identity

**Triggers:** locked out of registrar, Gitea, Stripe, Bubble, email, cloud; lost MFA device.

## Steps

1. **Identify which identity** — registrar, payment, forge, email, secrets vault.
2. **Break-glass account** — use documented secondary admin if available (see `AssetRegister.yaml` recovery_path).
3. **Offline recovery codes** — MFA reset via vendor recovery flow; requires pre-stored codes.
4. **Vendor support** — IONOS/Stripe identity verification; allow 24–48h; have domain ownership proof ready.
5. **Verify ownership** — confirm domain/registrar records unchanged; check for hostile transfer.
6. **Rotate compromised identity** — new password, new MFA, revoke active sessions.
7. **Restore dependent access** — Gitea/Forgejo admin, DNS, backup admin, OpenBao.
8. **Update registers** — record recovery paths discovered; close gaps in `AssetRegister.yaml` T0 section.
9. **Document** — evidence log; **no recovery codes in Git**.

## Prevention (ongoing)

- Record backup admin contacts per T0 asset.
- Store MFA recovery codes in password manager.
- Registrar lock enabled.

## References

`AssetRegister.yaml` T0 · `PanicSheet.md` §2 · `ResiliencePolicy.md`