Dual control that survives Tuesday
Dual control that only exists in a policy PDF fails on a busy Tuesday. Production dual control is enforced, staffed, and evidenced.
Part of Digital Asset Operations(3)
Most “dual control” is a slide.
It dies when:
- Shared admin is still on.
- The maker and checker are the same person after hours.
- The tool allows a bypass that nobody logs.
- The ticket closed without the evidence attached.
Tuesday is the test. Volume is up. Someone is on leave. The corridor is busy. Policy PDFs do not move.
Production dual control has four parts
- Policy that the system enforces, or a manual gate that is actually staffed.
- Segregation that survives staffing gaps: named roles, not heroics.
- An exception path with a register, not a private chat.
- Evidence that the dual-control event happened, linked to the work item.
If any one of those is missing, you have theatre.
Where it should live
In an application, not a procedure document. Maker/checker, approval routing, the exception register and evidence capture belong in the operating layer that sits across your custody, screening and ticketing tools. That is what our Virtual Asset Operator Control Plane foundation is built for.
We do not sell a new custody product and we never hold keys. A Solution Definition Sprint maps where dual control fails today for one workflow. An AI Production Sprint configures the application on the stack you already run.
Red flags in a first conversation
- “We have dual control,” but nobody can show last week’s maker/checker record.
- Owner keys discussed as something we would hold. We will not.
- A request to “make the tool compliant” without naming the workflow.
Digital asset applications · How we work
Next step: If dual control fails on a real book this month, bring us the workflow. That is a production problem, not a branding problem.
Fence: We build and integrate applications on client-owned systems. No owner or root admin. No keys.