6.2 Dual Control Workflows, Multi-Level Approvals & Master Approver

6.2 Dual Control Workflows, Multi-Level Approvals & Master Approver

Quick Answer: Dual Control (the Four-Eyes principle) is a CyberArk authorization framework enforcing multi-person integrity by preventing users from viewing, copying, or connecting with privileged credentials without authorization from designated approvers. Configured at Master Policy or platform levels and enforced at Safe level, Dual Control requires submitting access tickets in PVWA specifying a business reason, ticketing ID, and time window. Notifications are routed via the Event Notification Engine (ENE) across single-level or multi-level approval hierarchies. For emergency break-glass situations, designated Master Approvers or users with Access Safe without authorization override standard approval rules.

---

The Dual Control Governance Framework

Granting unconstrained access to high-privilege credentials—such as domain administrators, database root users, and break-glass identities—introduces severe insider threat and operational risks. Dual Control (the "Four-Eyes Principle" or two-person integrity) resolves this vulnerability by ensuring that no single individual can unilaterally retrieve or use a sensitive credential. At least two authorized individuals—a requester and an independent approver—must participate in every access grant.

Dual Control operates across two architectural levels:

1. Master Policy Level: Mandated under the Master Policy rule "Require dual control password access approval", toggled globally or configured with specific platform exceptions.
2. Safe Level: The Safe Access Control List (ACL) defines authorized approvers and requesters. Approvers must possess specific Safe rights over the target accounts.

When Dual Control is active, viewing, copying, or launching PSM sessions is intercepted until formal authorization completes.

---

PVWA Access Request Submission Workflow

When accessing an account governed by Dual Control, PVWA intercepts the operation and presents the Request Access modal interface. Requesters must provide mandatory parameters bounding access:

• Reason / Business Justification: Mandatory text explaining the operational necessity for access (e.g., "Applying quarterly security patches to production SQL cluster").
• Ticketing System ID: Ticket number from enterprise ITSM platforms (ServiceNow, BMC Remedy, Jira). When ticketing integration is active, the Vault queries ITSM APIs to verify the ticket is open, approved, and assigned to the requester.
• Access Timeframe (Time Window): Explicit Start Date/Time and End Date/Time bounding access. Credentials cannot be accessed before the start time, and access automatically terminates once the end time expires.
• Request Type: Single Access (one connection or check-out event) or Multiple Access (unlimited sessions within the approved window).

---

Notification Routing via Event Notification Engine (ENE)

Submitted requests trigger the Event Notification Engine (ENE) service (CyberArk Event Notification Engine) running on the Vault:

• Event Detection: ENE detects internal CreateRequest transaction logs in the Vault database.
• Approver Resolution: ENE inspects the target Safe's ACLs to identify all users and groups possessing the Authorize account requests permission.
• Email Dispatch: Over TCP port 25 (SMTP), ENE transmits email alerts containing requester identity, target account, Safe name, justification, ticket ID, timeframe, and a direct deep-link to the PVWA Request Review console.

---

Safe Permissions & Approver Entitlements

Dual Control relies on granular Safe permissions to strictly separate requesters from approvers:

• Authorize account requests: Designates an Approver, entitling identities to view pending requests, inspect tickets, and confirm or reject submissions.
• Access Safe without authorization: Allows designated emergency accounts to bypass Dual Control entirely, granting instant access without submitting requests.
• Manage Safe: Grants Safe administration rights, but does not grant approval authority unless Authorize account requests is also assigned.

Standard requesters only require operational permissions on the Safe (Use account, Retrieve accounts, List accounts).

---

Single-Level vs. Multi-Level Approvals

CyberArk supports two approval hierarchies to accommodate diverse governance requirements:

Single-Level Approvals

In a single-level configuration, one or more approver groups are assigned Authorize account requests on the Safe. Any single member can confirm the request. Upon confirmation, status transitions to Authorized, allowing immediate access within the approved window.

Multi-Level Approvals (Tiered Governance)

For high-risk environments (Tier-0 domain controllers, core financial databases), enterprises enforce Multi-Level Approvals:

• Sequential Sign-Off: Requires sequential authorization across two tiers: Level 1 Approvers (operational managers or asset owners) followed by Level 2 Approvers (Information Security or SOC).
• Enforcement Mechanics: Level 1 approvers are notified first. The request remains pending until Level 1 confirms, after which Level 2 is notified.
• Final Authorization: Only after Level 2 confirms does the request become Authorized.
• Rejection Finality: If an approver at either level rejects the request, the workflow terminates immediately with a Rejected status and access is denied.

---

Emergency Access, Master Approver Override & Break-Glass Protocols

During Sev-1 outages when standard approvers are unreachable, CyberArk provides emergency override mechanisms:

• Master Approver Role: Senior security authorities (CISO, PAM Architecture Lead, or Vault Administrator) assigned Master Approver rights can authorize pending requests across any Safe, bypassing multi-level tiers while preserving full audit logging.
• Break-Glass Accounts: Dedicated emergency identities pre-assigned Access Safe without authorization on emergency Safes. Accessing credentials via break-glass identities bypasses approval gates while triggering immediate high-severity Syslog alerts (ports 514/6514) to SIEM and PTA.

---

Dual Control Approval Workflows & Governance Models Comparison

The following table outlines the operational differences between CyberArk authorization mechanisms: