Two-Person Rule¶
Dual authorization control — instantiates Invariant Guarding
Requires two authorized people to independently confirm a high-risk transition before it proceeds, so no single actor can break the invariant alone.
A Two-Person Rule requires two authorized individuals to independently confirm a high-risk transition before it can proceed, so that no single actor — mistaken, coerced, or malicious — can break the invariant alone. Its defining move is that the guard condition is a second independent human judgment, with both identities recorded and accountable: correctness rests not on an automatic check of system state but on two people separately agreeing the transition is legitimate. It converts a unilateral action into a jointly authorized one, so breaking the invariant would take two independent failures at once.
Example¶
A bank's operations team can initiate outbound wire transfers. The invariant: no large transfer leaves the bank without two authorized officers independently agreeing it is legitimate — a guard against both honest error and insider fraud. The system enforces maker-checker separation: the officer who creates a wire above a threshold cannot release it, and a second, different authorized officer must independently review the beneficiary, amount, and supporting instruction before approving. One afternoon a maker, socially engineered by a convincing impersonation, submits a fraudulent $2M wire. The checker, reviewing independently against the client's known accounts, notices the beneficiary does not match and rejects it. The fraud is stopped because breaking the invariant would have required two people to be deceived at once — and both the submission and the rejection are logged with the officers' identities.
How it works¶
- Split the transition. The act is divided into "initiate" and "independently approve," performed by two distinct authorized people.
- Enforce genuine independence. The second review must be its own judgment — a different person, ideally reviewing without anchoring on the first — not a shared decision.
- Record both hands. Both identities and their decisions are captured, so accountability for the transition is unambiguous.
- Human agreement is the gate. The check is two people concurring, not an automatic condition on state and not an inspection of the underlying data's substance.
Tuning parameters¶
- Trigger threshold — which transitions require two people (all of them vs. only those above a risk or value line). A lower threshold is safer but adds friction to routine work.
- Independence enforcement — role separation, blind (un-anchored) second review, and approver rotation to defeat collusion. Stronger independence costs more coordination.
- Approver-pool size — how many people are eligible to be the second signer. Too small invites collusion or bottlenecks; too large dilutes familiarity with the work.
- N-person escalation — two signers vs. three or more for the very highest-risk transitions.
When it helps, and when it misleads¶
Its strength is defending against single points of failure that automation cannot catch — social engineering, insider fraud, a lone operator's slip — by requiring independent agreement, the four-eyes principle, and it establishes clear accountability for who authorized what.[n1]
Its central failure mode is rubber-stamping: the second approval becomes pro forma, the checker clicks approve without an independent look, and two-person collapses back to one-person while still appearing compliant. The classic misuse is a pairing that always approves — a manager reflexively signing off a subordinate's requests — or outright collusion between the two, either of which nullifies the guard. The guarding discipline is to enforce genuine independence: rotate approvers, keep the second review blind where feasible, and monitor approval patterns for the tell-tale signature of rubber-stamping.
How it implements the components¶
guard_condition— the transition is approved only when a second authorized person independently confirms it, the rule's central test.invariant_owner— accountability is assigned by name: both approvers own the decision, so responsibility for the invariant is never diffuse.audit_trace— both identities and their approvals are recorded for review.
Its guard is a second human, not an automatic condition; it does not inhibit a physical action on system state (transition_scope wired to actuation, violation_response_path) the way a Safety Interlock does, nor check the substantive evidence of the transition (validation_rule) the way a Contract Check does.
Related¶
- Instantiates: Invariant Guarding — the Two-Person Rule is the human, dual-authorization realization of the archetype.
- Sibling mechanisms: Database Constraint · Safety Interlock · Invariant Test Suite · Contract Check · Policy Guardrail · Integrity Monitor · Rollback Transaction
Editorial Notes¶
Form Classification¶
Form family: Rule, Policy & Commitment
Rationale: Two Person Rule is defined in the frozen evidence as: Requires two authorized people to independently confirm a high-risk transition before it proceeds, so no single actor can break the invariant alone. Its operative deployed or enacted form is therefore Rule, Policy & Commitment.
Nearest alternative: Decision, Gate & Allocation — Decision, Gate & Allocation can support this mechanism, but the evidence centers the concrete operation described above rather than the alternative family's defining operation.
Review outcome: Adjudicated after independent review; medium confidence.
Origin Attribution¶
Primary origin: Security Studies & Intelligence Analysis
Origin pattern: Single lineage
Present-day reach: Multi-domain
Rationale: Two authorized people independently observing or confirming a sensitive operation is the named two-person security rule. NIST defines the control and DOE specifies training, documentation, mutual observation, and detection of unauthorized or incorrect procedures.
Related originating lineages:
- Computer Science & Software Engineering — Computer science and software-engineering practice supplies a parallel or contributing lineage for the mechanism's defining operation: requires two authorized people to independently confirm a high-risk transition before it proceeds, so no single actor can break the invariant alone.
- Law & Governance — Legal doctrine, regulatory governance, and procedural accountability supplies a parallel or contributing lineage for the mechanism's defining operation: requires two authorized people to independently confirm a high-risk transition before it proceeds, so no single actor can break the invariant alone.
- Organizational & Management Science — Organizational design, management, and operational governance supplies a parallel or contributing lineage for the mechanism's defining operation: requires two authorized people to independently confirm a high-risk transition before it proceeds, so no single actor can break the invariant alone.
- Systems Thinking & Cybernetics — Feedback, system boundaries, stocks, flows, and regulation supplies a distinct formative lineage for the mechanism's two person rule logic.
Review resolution: The blind reviewers disagree on primary lineage (organizational_management versus security_intelligence). Authoritative or primary research supports security_intelligence as the best historical origin: Two authorized people independently observing or confirming a sensitive operation is the named two-person security rule. NIST defines the control and DOE specifies training, documentation, mutual observation, and detection of unauthorized or incorrect procedures. The cited NIST CSRC Glossary, Two-Person Control; U.S. Department of Energy, Nuclear Materials Control and Accountability directly supports the mechanism's defining operation. All independently supported contributing domains are retained without an arbitrary cap. origin_mode=single_lineage records lineage, while domain_reach=multi_domain records later applicability separately from provenance.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Researched adjudication after independent review; high confidence.
Sources consulted:
- NIST CSRC Glossary, Two-Person Control
- U.S. Department of Energy, Nuclear Materials Control and Accountability
Notes¶
Its nearest twin is the Safety Interlock: both block a hazardous transition until an enabling condition is met. The one-sentence separation: a Two-Person Rule's enabling condition is a second independent human authorization with recorded accountability, while a Safety Interlock's enabling condition is an automatic check on physical/system state.
[n1] Four-eyes principle — the requirement that a significant action be reviewed and approved by at least two people ("four eyes") before it takes effect; the military "two-man rule" for arming nuclear weapons is its best-known form. ↩