{"id":16079,"date":"2026-05-06T20:00:00","date_gmt":"2026-05-06T18:00:00","guid":{"rendered":"https:\/\/tricise.com\/?p=16079"},"modified":"2026-05-06T20:04:36","modified_gmt":"2026-05-06T18:04:36","slug":"responsable-des-versions-3c-habilitation-principe-des-quatre-yeux","status":"publish","type":"post","link":"https:\/\/tricise.com\/fr\/3c-release-manager-enablement-four-eyes-principle\/","title":{"rendered":"3C Release Manager pour Automic et Enablement Serie : principe du double contr\u00f4le pour les d\u00e9ploiements"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"16079\" class=\"elementor elementor-16079\" data-elementor-post-type=\"post\">\n\t\t\t\t<div class=\"elementor-element elementor-element-333b453 e-flex e-con-boxed e-con e-parent\" data-id=\"333b453\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-dda45f9 elementor-widget elementor-widget-text-editor\" data-id=\"dda45f9\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"blog-content blog-content--pre-video\">\n \n  <p>In regulated industries, a deployment is never just a technical action \u2014 it is an auditable event. Banks, insurers, public-sector organizations, and any enterprise operating under the <strong><a href=\"https:\/\/www.sec.gov\/about\/laws\/soa2002.pdf\" target=\"_blank\" rel=\"noopener\">Sarbanes-Oxley Act<\/a><\/strong>, the EU\u2019s <strong><a href=\"https:\/\/www.eiopa.europa.eu\/digital-operational-resilience-act-dora_en\" target=\"_blank\" rel=\"noopener\">Digital Operational Resilience Act (DORA)<\/a><\/strong>, <strong><a href=\"https:\/\/www.iso.org\/standard\/27001\" target=\"_blank\" rel=\"noopener\">ISO\/IEC 27001<\/a><\/strong>, or BaFin\u2019s <strong><a href=\"https:\/\/www.bafin.de\/SharedDocs\/Veroeffentlichungen\/EN\/Meldung\/2018\/meldung_180209_BAIT_en.html\" target=\"_blank\" rel=\"noopener\">Supervisory Requirements for IT in Financial Institutions (BAIT)<\/a><\/strong> shares the same baseline expectation: no single person should be able to move code or configuration into a production-grade system unannounced and unchallenged. That is the core idea behind dual sign-off, and it is one of the most frequently cited controls in IT audits of automation platforms. Part 6 of the <strong><a href=\"https:\/\/tricise.com\/products\/3c-release-manager\/\">3C Release Manager for Automic Enablement Series<\/a><\/strong> focuses on how this control is implemented \u2014 and technically enforced \u2014 directly inside the deployment workflow.<\/p>\n \n  <h2>Previously in this series<\/h2>\n \n  <p>This article continues the <strong>3C Release Manager for Automic Enablement Series<\/strong>. If you missed the earlier parts, here is where to catch up:<\/p>\n \n  <ul>\n    <li>Part 1 \u2014 <strong><a href=\"https:\/\/tricise.com\/3c-release-manager-for-automic-enablement-series\/\">Snapshot Function<\/a><\/strong>: capturing the full state of an Automic client as a timestamped baseline.<\/li>\n    <li>Part 2 \u2014 <strong><a href=\"https:\/\/tricise.com\/3c-release-manager-enablement-series-diff-function\/\">Diff Function<\/a><\/strong>: comparing snapshots to detect object changes and verify release transparency.<\/li>\n    <li>Part 3 \u2014 <strong><a href=\"https:\/\/tricise.com\/3c-release-manager-enablement-series-environments\/\">Creating Environments<\/a><\/strong>: defining the technical connections to Automic clients that make snapshots, diffs, and deployments possible.<\/li>\n    <li>Part 4 \u2014 <strong><a href=\"https:\/\/tricise.com\/3c-release-manager-enablement-series-deployments\/\">Controlled Deployments<\/a><\/strong>: transporting objects between clients with automatic backups and a defined rollback path.<\/li>\n    <li>Part 5 \u2014 <strong><a href=\"https:\/\/tricise.com\/3c-release-manager-enablement-series-rel-deployments\/\">Add Related<\/a><\/strong>: collecting nested workflow dependencies down to script level in a single action.<\/li>\n  <\/ul>\n \n  <p>With controlled, dependency-complete transports in place, the next question moves from <em>can we deploy safely?<\/em> to <em>can we prove that the change was authorized?<\/em> That is exactly where this control comes in.<\/p>\n \n  <h2>Why dual sign-off matters in regulated Automic environments<\/h2>\n \n  <p>Automic Automation typically sits at the heart of mission-critical workloads \u2014 payment processing, regulatory reporting, supply chain orchestration, batch windows that the rest of the business depends on. A change to a workflow in this environment is not an isolated technical adjustment. It is a change to a system whose failure has direct business and, in regulated sectors, regulatory consequences.<\/p>\n \n  <p>Auditors know this, and their questions tend to be uncomfortably specific. <em>Who approved this change? When? Was the approver a different person from the one who prepared it? Where is the evidence?<\/em> If those questions can only be answered with screenshots, ticket links pasted into emails, or \u201cwe trust our team\u201d, the control is not actually a control \u2014 it is an honor system. Segregation of duties exists precisely to remove that ambiguity by making independent authorization a precondition for execution, not a procedural recommendation.<\/p>\n \n  <p>In a traditional Automic setup, enforcing this typically requires a patchwork of external ticketing workflows, manual sign-offs in a change advisory board tool, and operational discipline that depends entirely on people remembering to follow the process. The <strong><a href=\"https:\/\/tricise.com\/products\/3c-release-manager\/\">3C Release Manager for Automic<\/a><\/strong> moves that enforcement into the deployment itself.<\/p>\n \n  <h2>How dual approval is enforced in the 3C Release Manager<\/h2>\n \n  <p>The mechanism is built into the environment configuration. For any target environment \u2014 typically the ones representing pre-production and production clients \u2014 the number of required approvals can be set in the additional settings. Setting this value to two activates the control for that environment: every transport targeting that client will require sign-off from two <strong>distinct users<\/strong> before it can be executed.<\/p>\n \n  <p>The enforcement is technical, not procedural. When a deployment is prepared and reaches the <em>Preparation Ready<\/em> state, the Run button does not become available until the approval threshold is met. The user who created and prepared the package can provide their own sign-off, but that single approval is not sufficient to execute. A second confirmation, from a different user, is mandatory. Until that second approval is recorded, execution cannot proceed \u2014 there is no override, no workaround, no \u201cjust this once\u201d.<\/p>\n \n  <p>The short demo below shows the full flow end-to-end: a transport prepared by User A, the Run button intentionally locked, and the second sign-off from User B unlocking execution.<\/p>\n \n<\/div>\n \t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-2bb4502 e-flex e-con-boxed e-con e-parent\" data-id=\"2bb4502\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a5cbffa elementor-widget elementor-widget-video\" data-id=\"a5cbffa\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;youtube_url&quot;:&quot;https:\\\/\\\/youtu.be\\\/96XC2v6Gk5k&quot;,&quot;video_type&quot;:&quot;youtube&quot;,&quot;controls&quot;:&quot;yes&quot;}\" data-widget_type=\"video.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-wrapper elementor-open-inline\">\n\t\t\t<div class=\"elementor-video\"><\/div>\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-80134be e-flex e-con-boxed e-con e-parent\" data-id=\"80134be\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-e2e5a5e elementor-widget elementor-widget-text-editor\" data-id=\"e2e5a5e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"blog-content blog-content--post-video\">\n \n  <h2>What this actually changes for compliance and audit<\/h2>\n \n  <p>Embedding independent sign-off directly into the deployment tooling changes four things that auditors, risk officers, and release managers care about:<\/p>\n \n  <ul>\n    <li><strong>Segregation of duties becomes verifiable.<\/strong> The approval is tied to the user identity that recorded it, not to a free-text field or a forwarded email. Audit logs can show, for any given transport, exactly which two users approved it and when \u2014 and that those two users were genuinely distinct.<\/li>\n    <li><strong>The control cannot be bypassed under pressure.<\/strong> End-of-quarter pressure, urgent hotfixes, and \u201cthe other approver is on vacation\u201d are exactly the moments when manual processes quietly degrade. A technically enforced threshold does not degrade. The change either has two sign-offs, or it does not run.<\/li>\n    <li><strong>Audit evidence becomes a byproduct, not a project.<\/strong> When an auditor asks for evidence that segregation of duties was applied to production changes over the last quarter, the answer is a query against the deployment history \u2014 not a scramble to reconstruct who approved what from email archives.<\/li>\n    <li><strong>Release governance becomes consistent across teams.<\/strong> Different teams often have different levels of process maturity. Enforcing dual sign-off at the environment level means the standard is applied uniformly to every change targeting that environment, regardless of which team prepared it.<\/li>\n  <\/ul>\n \n  <h2>Where dual sign-off fits in the broader release framework<\/h2>\n \n  <p>This control is not a standalone feature \u2014 it is one layer in a release governance model that the <strong>3C Release Manager<\/strong> assembles end-to-end. Snapshots provide the baseline. Diffs make changes transparent. Controlled transports add backups and rollback. Recursive related-object collection ensures completeness. Approval enforcement adds authorization.<\/p>\n \n  <p>Together, these layers answer the questions auditors actually ask: <em>What was the state before? What changed? Who authorized the change? Could it be reversed if needed?<\/em> Each layer is useful on its own; the value compounds when they are used together as a single, coherent release process.<\/p>\n \n  <p>For organizations operating under DORA\u2019s ICT change management requirements (see also the <strong><a href=\"https:\/\/www.bundesbank.de\/en\/tasks\/banking-supervision\/individual-aspects\/risk-management\/bait\/bait-dora-741194\" target=\"_blank\" rel=\"noopener\">Deutsche Bundesbank guidance on the BAIT-to-DORA transition<\/a><\/strong>), BAIT\u2019s segregation-of-duties expectations, or any of the comparable frameworks that govern critical systems, this is the difference between <em>claiming<\/em> a controlled release process and <em>demonstrating<\/em> one.<\/p>\n \n  <h2>Key takeaways<\/h2>\n \n  <ul>\n    <li>Independent dual sign-off is one of the most frequently audited controls in regulated IT environments, and it is a baseline expectation under frameworks such as SOX, DORA, ISO 27001, and BAIT.<\/li>\n    <li>The <strong><a href=\"https:\/\/tricise.com\/products\/3c-release-manager\/\">3C Release Manager for Automic<\/a><\/strong> enforces it technically by requiring a configurable number of distinct user approvals per environment before a transport can be executed.<\/li>\n    <li>Approval enforcement is built into the deployment workflow, not layered on top through external ticketing \u2014 the Run button is unavailable until the threshold is met.<\/li>\n    <li>The result is verifiable segregation of duties, audit evidence as a byproduct of the process, and consistent governance across teams and changes.<\/li>\n    <li>Combined with snapshots, diffs, controlled transports, and recursive object collection, this control completes a release framework that maps cleanly to real audit requirements.<\/li>\n  <\/ul>\n \n  <p>Compliance-grade release management is not about adding more steps. It is about making sure the steps that matter are enforced by the platform, recorded automatically, and easy to evidence after the fact. The <strong><a href=\"https:\/\/tricise.com\/products\/3c-release-manager\/\">3C Release Manager for Automic<\/a><\/strong> is built around exactly that principle.<\/p>\n \n  <p>Want to see how the <strong><a href=\"https:\/\/tricise.com\/products\/3c-release-manager\/\">3C Release Manager<\/a><\/strong> maps to your organization\u2019s audit and compliance requirements? <strong><a href=\"https:\/\/tricise.com\/contact\/\">Schedule a free consultation<\/a><\/strong> to discuss your release governance landscape \u2014 or explore the <strong><a href=\"https:\/\/tricise.com\/university\/\">full Automic course path at Tricise University<\/a><\/strong> to build release governance skills across your team.<\/p>\n \n<\/div>\n \n \n<!-- ============================================================ -->\n<!-- STRUCTURED DATA (JSON-LD) \u2014 f\u00fcr GEO \/ AI-Suche \/ Rich Results -->\n<!-- ============================================================ -->\n<script type=\"application\/ld+json\">\n{\n  \"@context\": \"https:\/\/schema.org\",\n  \"@type\": \"Article\",\n  \"headline\": \"3C Release Manager for Automic Enablement Series: Four-Eyes Principle\",\n  \"description\": \"Part 6 of the 3C Release Manager for Automic Series: enforce dual approval for deployments to meet SOX, DORA, ISO 27001 and BAIT requirements.\",\n  \"keywords\": \"four-eyes principle, dual approval, segregation of duties, Automic Automation, Automic deployments, 3C Release Manager, release governance, compliance, audit, SOX, DORA, BAIT, ISO 27001, change management, deployment approval\",\n  \"articleSection\": \"Automic Automation\",\n  \"image\": {\n    \"@type\": \"ImageObject\",\n    \"url\": \"https:\/\/tricise.com\/wp-content\/uploads\/2026\/05\/3c-four-eyes-principle.png\",\n    \"caption\": \"four-eyes principle for Automic deployments\"\n  },\n  \"author\": {\n    \"@type\": \"Organization\",\n    \"name\": \"Tricise\",\n    \"url\": \"https:\/\/tricise.com\/\"\n  },\n  \"publisher\": {\n    \"@type\": \"Organization\",\n    \"name\": \"Tricise\",\n    \"logo\": {\n      \"@type\": \"ImageObject\",\n      \"url\": \"https:\/\/tricise.com\/wp-content\/uploads\/2025\/04\/Tricise-Logo-200x21.png\"\n    }\n  },\n  \"mainEntityOfPage\": {\n    \"@type\": \"WebPage\",\n    \"@id\": \"https:\/\/tricise.com\/3c-release-manager-enablement-series-four-eyes-principle\/\"\n  },\n  \"about\": [\n    { \"@type\": \"Thing\", \"name\": \"Four-Eyes Principle\" },\n    { \"@type\": \"Thing\", \"name\": \"Segregation of Duties\" },\n    { \"@type\": \"Thing\", \"name\": \"Automic Automation\" },\n    { \"@type\": \"Thing\", \"name\": \"DORA\", \"url\": \"https:\/\/www.eiopa.europa.eu\/digital-operational-resilience-act-dora_en\" },\n    { \"@type\": \"Thing\", \"name\": \"BAIT\", \"url\": \"https:\/\/www.bafin.de\/SharedDocs\/Veroeffentlichungen\/EN\/Meldung\/2018\/meldung_180209_BAIT_en.html\" },\n    { \"@type\": \"Thing\", \"name\": \"ISO 27001\", \"url\": \"https:\/\/www.iso.org\/standard\/27001\" },\n    { \"@type\": \"Thing\", \"name\": \"SOX\" }\n  ]\n}\n<\/script>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>3C Release Manager pour la s\u00e9rie Automic : imposer une double validation pour les d\u00e9ploiements afin de respecter les exigences SOX, DORA, ISO 27001 et BAIT.<\/p>","protected":false},"author":59,"featured_media":16106,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[152],"tags":[],"class_list":["post-16079","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-automic-automation"],"acf":[],"meta_box":[],"_links":{"self":[{"href":"https:\/\/tricise.com\/fr\/wp-json\/wp\/v2\/posts\/16079","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tricise.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tricise.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tricise.com\/fr\/wp-json\/wp\/v2\/users\/59"}],"replies":[{"embeddable":true,"href":"https:\/\/tricise.com\/fr\/wp-json\/wp\/v2\/comments?post=16079"}],"version-history":[{"count":0,"href":"https:\/\/tricise.com\/fr\/wp-json\/wp\/v2\/posts\/16079\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tricise.com\/fr\/wp-json\/wp\/v2\/media\/16106"}],"wp:attachment":[{"href":"https:\/\/tricise.com\/fr\/wp-json\/wp\/v2\/media?parent=16079"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tricise.com\/fr\/wp-json\/wp\/v2\/categories?post=16079"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tricise.com\/fr\/wp-json\/wp\/v2\/tags?post=16079"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}