What is the four-eyes principle?
The four-eyes principle means that a sensitive change or action needs approval from two people.
The principle is well known in finance and administration. The person who records a payment is not the person who authorises it, so a single mistake or a single person's intent cannot on its own have serious consequences.
NIST describes the closely related principle of separation of duty, under which no user should have enough privileges to misuse the system on their own.
In IT systems the principle is used for changes that affect security, such as new roles, altered sign-in rules or the removal of users. The change takes effect only once a second authorised person has approved it.
How it works
When someone requests a sensitive change, it is saved as a pending request. Another authorised person reviews it and approves or rejects it. Both steps are logged, so it is possible to see afterwards who asked and who approved.
The person requesting a change can never approve it themselves. Otherwise the principle loses its purpose.
Why it matters
The principle protects against both mistakes and misuse. A hijacked administrator account is not enough to weaken security, and a wrong change is often caught by the reviewer. In regulated organisations it is also a way of showing that controls work.
What to keep in mind
Use the principle where the consequences are greatest, so it does not become a formality. If everything needs two approvals, people start approving without reading.
The same idea suits AI. An AI agent about to do something that cannot be undone may need a person's approval first, and every decision ends up in the audit log.
What it means for you
Decide which changes are sensitive enough to need two people. Changes to access and security are usually a good place to start.
Common questions
Is the four-eyes principle a legal requirement?
No general law requires it as such. Several regulations do require controls and separation of duties, and the principle is a common way of meeting them.
Does it slow work down?
Slightly, for the changes it covers. That is why it should apply to the changes that affect security most. Read more about the audit log.
Sources: NIST on separation of duty
Related terms
Read more
All terms Updated