A zero-knowledge password manager faces a recovery dilemma: how to regain access without a master backdoor. Having a single "god mode" credential would create a major single point of failure exploitable by attackers. Instead, Passwork designed access recovery using three isolated tiers, each with a specific, limited function.Tier one, the emergency console, requires server-level access and explicit activation to reset an Owner's login credentials when normal recovery fails. This console only restores login access, not vault decryption capabilities. Every action taken by the emergency console is logged for auditability.Tier two is the offline recovery account, which uses pre-shared cryptographic grants for specific vault types. This account's access is limited to what was configured before an incident, preventing retroactive access grants. The master password for this account must be stored securely offline.Tier three addresses service accounts, ensuring they are solely for programmatic access via API tokens, not interactive logins. Leaked tokens only compromise resources explicitly granted to that integration. This prevents automation credentials from becoming universal backdoors.This three-tier approach avoids a single master key by distributing trust across distinct, auditable, and narrowly scoped mechanisms. Recovering access does not rely on one privileged credential that can unlock everything. The design emphasizes recovering access without concentrating security risks. Ultimately, security is achieved by distributing trust, not by consolidating it into one point.