Blog · 28 Feb 2026 · 9 min

Dual control without deadlock

Two colleagues reviewing a document together

Two-person rules protect against unilateral mistakes. They also freeze work when both named people travel, fall ill, or disagree about timing. Deadlock is usually a design flaw, not proof that dual control “doesn’t work.”

Split approval from presence

One role can authorize the ceremony window; another can be physically present with devices. Write that split down. Video presence may satisfy policy for approvals while a local custodian handles hardware — only if your policy explicitly allows it.

Name substitutes before you need them

Each primary role needs a trained alternate who has completed a tabletop. Alternates who only appear on crisis day will slow you down and raise error risk.

Time-box disagreements

If two controllers cannot agree to proceed, the script should say “abort and reschedule,” not “debate until midnight.” Abort is a successful use of dual control.