The four-eyes principle reduces security risk by requiring at least two people to review and approve a critical action before it is implemented. One person prepares the change; another checks whether it is safe, necessary, and unlikely to disrupt the system. section 5.1
Apply the principle to changes that could affect security or availability:
- Require independent approval for code releases, configuration updates, database migrations, and other critical system changes. section 5.1
- Give approvers authority to reject a change or request additional safeguards instead of rubber-stamping it. section 5.1
- Record approvals in tickets and source control so teams can identify recent changes when troubleshooting unexpected errors. section 5.1
- Combine human review with unit tests before merging changes into the main branch or deploying them externally. section 5.11
A protected pull request
A developer opens a pull request for an externally facing release. GitHub requires another team member to review and approve it, while unit tests must pass before the change can be merged. The second reviewer can block the release when a security lapse or disruptive behavior is suspected. section 5.11
