What is dual-control (maker-checker)?
Dual-control, also called maker-checker, requires two different people for a sensitive action: one to request it and a different one to approve it. It is enforced by the system, not by policy alone, so no single account can quietly hand itself power or push a sensitive change through unchecked.
Maker and checker
The maker requests the action; the checker approves it. The two cannot be the same person. Until the checker approves, the action is pending and has not taken effect — so a sensitive change always has a second authorized pair of eyes on it before it becomes real.
What triggers dual-control
The clearest case in Staff Admin & Security is a sensitive role grant: no one grants themselves a sensitive permission. One staff member requests the grant, a different staff member approves it, and the approval is written to the audit log. The same maker-checker pattern appears on sensitive actions across Ustawi, such as write-offs, precisely because those actions affect the books or the risk position and should never be a solo decision.
The flow
- 1Maker requestsA staff member initiates the sensitive action — for example requesting a sensitive role grant.
- 2Checker approvesA different, authorized staff member reviews and approves. They cannot approve their own request.
- 3Audit log entryThe approval is written to the audit log with who acted and when, so the decision is reconstructable later.
A policy that says “two people must sign off” can be ignored under pressure. Enforcing maker-checker in the system means the sensitive action simply cannot complete without the second person.