Most four-eyes controls assume two administrators at one console at the same time — which is why they end up switched off. goca's multi-person approval is asynchronous, which is the point: you propose a change, and a colleague approves it later, from their own session, on their own day. A gated change answers "recorded, not applied" — queued, not blocked.
The details are as careful as the idea. Enabling refuses until people + 1 administrators are eligible, so one departure can't strand the control. Once on, you cannot turn it off alone. And a rejection is a vote, not a veto — no single administrator holds a permanent veto over the management plane. Tightening a policy is free; only loosening needs company — with one deliberate exception: the sign-in policy is gated in both directions, because a hostile tightening there can lock every administrator out.
You'll see what it gates — and what it deliberately doesn't — in Users, MFA & Multi-Person Control.