Separation of duties
Separation of duties divides responsibilities and access permissions so that one person cannot independently perform a defined set of conflicting or sensitive functions.
Start with the actions one person must not combine
NIST’s AC-5 control asks organizations to identify duties that need separating and assign permissions accordingly. Keeping system administration separate from audit administration is one example: the person making changes should not also have unrestricted control over the record of those changes.
Dual authorization is a more specific requirement for two people to approve an action. Separation of duties concerns the responsibilities each person can hold. You can use both, but adding a second approval field does not automatically separate the duties.
Two accounts can still belong to one person
Check who can request, approve, execute, and review a sensitive change. If a support agent can use another assigned role to approve their own recovery exception, the intended separation has failed. Different account names do not help when the same person controls both.
The same check matters when an approver is away. Define a usable backup approval route without giving the requester control of the approval. Separation reduces the opportunity for one person to misuse authorized access; it does not eliminate the possibility of two people colluding.