What is the four-eyes principle?
The four-eyes principle, also called dual control or two-person approval, is a rule that certain actions require two authorized people: one to request and another to approve. No single individual, and no single compromised account, can complete the action alone.
How does the four-eyes principle work?
A protected action is initiated by one person and held in a pending state. A second person, using a separate account, reviews and approves or rejects it. Only an approved request is executed, and both identities are recorded. Requests that are not answered within a set time expire. The control is long established in banking and in the handling of cryptographic keys, and it has been adopted in backup software for operations that remove data.
Which backup operations should require two people?
The principle is applied to actions that reduce the ability to recover, including the indirect ones.
| Action | Why it is covered |
|---|---|
| Deleting backups or restore points | Direct loss of recovery data |
| Shortening retention or immutability | Data expires sooner than intended |
| Removing a repository | Its contents may be orphaned or erased |
| Changing administrator accounts | Could create a second approver under one person |
| Disabling the approval feature | Would switch the control off |
What makes dual approval effective?
The two parties have to be independent. If both accounts depend on the same directory, an attacker who controls it controls both. If one administrator knows the other's password, there is in effect one person. Approver accounts should be named, individually held, protected by their own multi-factor authentication and, ideally, not tied to the production domain. In small teams the approver can be a manager, a security officer or an external provider. Backup deletion approval covers the workflow in practice.
How does it relate to immutability?
The four-eyes principle governs what administrators may do through the backup software, and it allows a justified deletion to proceed. Immutability governs the stored data itself and, in compliance mode, allows no deletion at all until the lock expires. The two are complementary. Approval protects configuration and data outside the lock period, and immutability protects recent restore points even if both approvers are compromised.
Frequently asked questions
Is the four-eyes principle the same as separation of duties?
They are related. Separation of duties assigns different tasks to different people. The four-eyes principle requires two people for the same task.
Does dual approval slow down operations?
Only for the few actions it covers. Routine backups and restores are unaffected.
What if only one administrator is available?
The request waits. That is why at least three eligible approvers are recommended, so absences do not block legitimate work.