Dual Control

Dual control is the rule that no single person can complete a sensitive operation alone: one participant initiates, a different one approves, and the system enforces the separation rather than relying on anyone to observe it. In crypto operations it is what stands between an internal actor and a withdrawal — moving funds out of storage, adding an address to a payout list, changing a limit or raising a signer's permissions typically all require a second, independent authorisation. Its value is that it defends against two very different failures with one control: someone acting dishonestly, and someone acting honestly but wrongly, since a second reviewer catches a pasted address as readily as a fraudulent one. It only works if the separation is genuine. Two accounts held by the same person, an approver who rubber-stamps without seeing what changed, or an emergency path that bypasses the requirement all restore the single point of failure while leaving the appearance of a control, and the emergency path is the one that fails most often.