Separation of duties
Split sensitive steps so one identity cannot control an entire transaction.
The idea
Separation of duties assigns incompatible responsibilities to different people or roles. It can prevent one person from both requesting and approving access, or both changing and verifying critical records. The control reduces unilateral abuse and catches mistakes. It must be supported by actual access restrictions and independent review, not simply by listing two names in a procedure. Small teams may need compensating controls where full separation is impractical.
In practice
A developer submits a production change; another authorized reviewer approves it; an audit log records the deployment. Emergency changes have a documented follow-up review.
A common misunderstanding
Two people sharing one administrator account do not provide reliable separation or accountability.
Check your understanding
What should an exception include?
Think it through: A defined reason, responsible owner, time limit, and an independent compensating review.
Identify incompatible authority
A fictional charity pays supplier invoices. One employee can enter an invoice, another approves it, and a controlled payment process releases the funds. The purpose is to prevent one person from creating and completing an unsupported payment without independent scrutiny. Listing three job titles does not achieve this if one shared account can perform every step.
Map actual permissions and alternate routes. A user who cannot approve an invoice in the main application might still alter the approval field through an administrative import. Emergency access and service accounts can also bypass ordinary workflow. The separation requirement should cover the effective authority, not just the visible interface.
Independence does not eliminate collusion or every mistake. Two reviewers can misunderstand the same evidence, and two people can deliberately cooperate. The control reduces particular unilateral risks and provides opportunities for detection. Supporting audit records and periodic review help make those opportunities useful.
Design for a small team
For the charity example, assume only two staff members are available. Identify which duties can remain separate and where a documented compensating review is necessary. Define a threshold, time limit, and independent reviewer for exceptional payments. Do not solve staffing pressure by silently sharing an administrator credential.
Use dummy invoices to test the normal and exceptional workflows. Verify that the requester cannot approve their own transaction through any supported route, and that emergency actions remain traceable. Review access after role changes because accumulated permissions can collapse an originally sound design. A workable separation-of-duties control combines explicit incompatibilities, enforceable permissions, and a realistic exception process that does not permanently erase the intended independence.
Keep exploring
References & further reading
Original explanations, with primary references for deeper study.
NIST: An Introduction to Information Security