Maker-checker (four-eyes principle)
Also called four-eyes principle, dual control, segregation of duties.
A control where one person makes a change and a different person must approve it before it takes effect.
Last updated
What it is.
The maker prepares an action, such as a payout, a limit change, a new user role or a price update. The checker reviews it and approves or rejects it. Until it is approved, the action does not take effect.
In software the important part is that the system enforces it: the same user cannot both make and approve, the approval is recorded with who, what and when, and the record cannot be edited afterwards.
Why it matters
It stops a single mistake or a single bad actor from moving money or changing access on their own. Banks, payment firms and insurers use it widely, and auditors for frameworks like SOC 2 look for segregation of duties on sensitive actions. It is also a natural pattern for human-in-the-loop review of AI actions.
Common mistakes.
- 01
Letting admins approve their own changes, which quietly defeats the control.
- 02
Rubber-stamp approvals with no detail shown to the checker.
- 03
No expiry on pending changes, so stale requests get approved weeks later.
Work it out with a tool.
Related terms.
- Human-in-the-loop (HITL)A design where a person reviews, corrects or approves what an AI system produces before it takes effect.
- SOC 2 Type IIAn independent audit report on whether a service organisation's controls were designed well and worked over a period of time.
- Cardholder data environment (CDE)The people, processes and systems that store, process or transmit payment card data, plus the systems connected to them.
- Guardrails (AI)Checks placed around an AI model that block, fix or flag unsafe, off-topic or incorrect inputs and outputs.
