Glossary
Separation of Duties
Separation of duties splits a sensitive action into steps that different parties must perform. A common pattern: one person requests a change, a different person approves it, and neither can do the other's part. The goal is not to slow things down for its own sake — it is to remove the single point of failure where one compromised or careless actor can complete an entire sensitive transaction alone.
The control only works if it is enforced by the system, not by convention. If a policy says two people must approve a production release but the tooling lets one person do both steps under two different accounts they control, the separation is fictional. Effective separation of duties is usually paired with identity verification strong enough that the system, not a human reviewer, can confirm the two parties are actually different.