A sensitive process should not be controlled end to end by one person. Separation of duties assigns conflicting responsibilities to different people, creating independent checks against error, misuse, or unauthorized change. section 14.3.2
A policy workflow illustrates the pattern: one engineer authors the policy, another reviews its implementation, a manager approves its intent and scope, a coordinator checks alignment with shared authorization standards, and an auditor verifies that governance continues to operate. section 14.3.2
Typical responsibility boundaries include:
- The author records and implements the policy, while a different engineer reviews the change. section 14.3.2
- The owner maintains policy relevance, while the approver confirms the intended business rule and scope. section 14.3.2
- The coordinator checks compatibility with organization-wide authorization conventions, while the auditor checks review timing, records, and follow-up actions. section 14.3.2
A policy change at ACME
Alice authors a policy and records its rationale. Bob reviews the implementation. Carol approves the intent and scope. Renee checks alignment with other teams, and Arnold later verifies that reviews, metadata, and follow-up actions are complete. Local teams retain responsibility while independent roles preserve accountability. section 14.3.2
Figure 14.5 Policy governance workflow across roles. Authorization policies move through clearly defined roles, from creation to deployment and review. Engineers author and review policy logic, managers approve intent and scope, access control coordinators ensure alignment across teams, and auditors verify that governance processes are followed over time. Separation of duties and feedback loops preserve accountability without centralizing control.
The workflow diagram makes the handoffs and feedback loops visible, showing how authoring, review, approval, coordination, and audit preserve accountability without centralizing every decision. section 14.3.2
In authorization systems, separation of duties is commonly expressed through role-based access control (RBAC). RBAC supports formal governance constraints and role hierarchies, whereas simpler groups generally organize identities without the same authorization structure. section 5.2.1 section 5.4
