Maintain the global zone by using the Trusted Path access. Trusted Path is only available on the console, so ensure that the console is accessible through the ILOM, a serial connection or through the graphical console.
Once a system is configured as an immutable global zone, use the break sequence on the console to access the trusted path console. Log in and assume the root role.
When a package update is performed, the first boot of the immutable Global Zone is read-write. The system needs these permissions to perform the required self-assembly steps. When the self-assembly steps have been performed, the system will reboot. In this second boot, the system becomes immutable again.