Separation of duties
Separation of duties is a control principle that distributes conflicting responsibilities among multiple people or roles so no individual can complete a sensitive operation alone.
Authorization in Action
Separation of duties is a control principle that assigns a sensitive process to multiple people so that no single person performs all conflicting responsibilities.
- How it is used
- Structures policy creation, approval, deployment, and review so conflicting responsibilities remain distributed across roles.
- How deep it goes
- Explains role boundaries and an operational workflow, while stopping short of detailed constraint syntax or runtime enforcement.
- Examples
- Uses an ACME policy workflow separating authoring, review, approval, coordination, and audit.
- What you can do after
- Evaluate authorization workflows for conflicting responsibilities and assign independent review, approval, coordination, and audit roles.
Read how Authorization in Action explains separation of duties →
Grokking Web Application Security
The four-eyes principle is a control requiring critical changes or actions to be reviewed by at least two people before implementation.
- How it is used
- Uses independent approval to catch security lapses before critical changes reach production.
- How deep it goes
- Explains approval roles, documentation, rejection authority, and code-review enforcement without detailing implementation internals.
- Examples
- Uses missile-launch key controls, critical-system changes, and GitHub pull requests with required approval and passing tests.
- What you can do after
- Apply it via GitHub, ticketing workflows, source control, and review policies to prevent unapproved critical changes.
Read how Grokking Web Application Security explains separation of duties →
Related concepts
- branch protectionimplemented by · Branch protection is a repository policy that restricts changes or operations on a branch unless specified conditions, such as checks or approvals, are met.
- pull requestuses · A pull request is a version-control proposal to integrate changes from one branch or repository into another, typically supporting review and discussion before merging.
- CODEOWNERS fileconfigured by · A CODEOWNERS file is a repository configuration file that maps file paths to people or teams responsible for reviewing changes to those paths.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.