Two signatures, a delay, a threshold
A gate can ask for two people instead of one, make the action wait after the last signature, or open only above an amount. It is all set in a policy, tool by tool.
When a gate asks for two signatures
- A policy asks it for a tool: « 2 signatures ».
- The tool is at level 4 or 5 — money, code, irreversible: it always takes two, whatever the policies say.
- A human gate of the graph declares it itself — as re-approving a remote agent does.
Several rules on the same tool: the strictest wins, none lowers what another asks. The number is fixed when the run starts: a policy edited along the way changes nothing for it.
Signing
- Two different people, each with the right to approve. At levels 4 and 5, neither the person who started the run nor the requester signs; below, the person who started the run may give one of the two, never both.
- The first signature is recorded and the run stays suspended; the second decides the gate, and the run resumes.
- A single refusal, with its reason, refuses the gate and ends the run.
- A two-signature gate is never decided in bulk. It says who may still sign, and they are told by e-mail.
Signers from different teams
A two-signature rule can require signers from teams that share nothing, or one of the two from a named team. A signature that does not meet the rule does not count, and the gate says why.
A delay before the action goes
A rule can make the action wait after the last signature: 15 minutes, 1 hour or 24 hours. The gate shows « Signed · leaves at » and the time. Until then, an approver or an owner can cancel the action: the run stops, nothing goes out, and the proof says who stopped it.
Above a threshold
A rule can apply only above a threshold, on a numeric argument of the call — an amount above 500, for instance. Below it, the call goes through without a gate. An argument that is missing, or is not a number, opens the gate anyway.
Not yet
SoonMore than two signatures, or « any two of these named people ».