Dual authorization
Dual authorization requires approval from two authorized individuals before a specified sensitive action can be executed.
Two people approve the action
NIST describes dual authorization as two-person control for actions the organization specifies. It can reduce insider risk, though collusion is still possible. The organization must decide which actions need it.
Copying someone on a message or notifying them after a change is not a second approval. Two authentication factors used by one person are not two-person approval either.
Both approvals must cover the same change
If one reviewer approves replacing an authenticator and the second approves replacing it plus resetting the password, the approvals do not cover the same action. Two names in the ticket are not enough; check what each person approved and what was actually done.
The workflow needs to define who can approve, which actions need both approvals, and what stops the change while one is missing. Test mismatched approvals as well as a missing approval.
Also plan for an unavailable reviewer. The approved escalation route needs to remain usable during urgent situations.