Most "dual control" dies of inconvenience: if two people must stand at one console, the control gets switched off by Friday. goca's multi-person approval is asynchronous, which is the point. You propose a change; a gated save answers "recorded, not applied" with a request id — queued, not refused. A colleague approves it later, from their own session, on their own day.
Enabling it refuses until people + 1 administrators exist: with exactly the quorum, one departure leaves nobody able to approve anything ever again — including turning the control off. And believe the warning: once on, no one turns it off alone.
The default scope gates what grants authority or weakens authentication — bindings, groups, identity creation, key custody, the control's own switches. Enrollment interfaces are deliberately not gated by default: making "add a template to a directory" a two-person ceremony is how controls end up disabled. Tightening is free; loosening needs company. A rejection is a vote, not a veto — a request dies only when as many refuse as would have been needed to agree.
Now I can turn on approval without grinding daily work to a halt.