Dividing what one person can compromise alone
Split knowledge divides a critical secret — a root key, a master credential — into parts distributed across several people, so that no individual's portion is sufficient on its own to reconstruct the whole. Compromising, coercing, or simply making a mistake with one holder yields only a fragment, not the secret itself. This trades a real security property for real operational cost: reconstructing the secret now requires actively coordinating multiple people rather than one person acting unilaterally.
Dual control applies the same underlying idea to actions rather than static secrets — requiring two independent parties to both act before a consequential operation proceeds, rather than splitting a value ahead of time. Both mechanisms are protecting against the same failure mode: one person, whether through compromise or error, being able to unilaterally cause serious harm.
Reserved for what actually warrants the friction
Neither split knowledge nor dual control is meant to apply broadly — the coordination overhead is deliberately real, and applying it to routine operational credentials would create friction without a corresponding benefit. The practice earns its cost specifically for the small number of secrets and actions where a single point of unilateral failure would be genuinely catastrophic, not as a default posture for every credential in a system.