Four-eyes approvals
Two operations always require a second person. In both, the approver needs the corresponding permission and cannot be the requester — no exceptions, not even root.
Account deletion
Deleting a user's account on a target system is requested and another person confirms. On confirmation:
- The deletion runs on the target (idempotent: if it no longer existed, it counts as done).
- The row remains as a tombstone: the username is not recycled and no automatic process re-creates the account.
- Pending grants on that connector are settled and open tasks are cancelled.
OU move
Moving a user to another OU (with its policy swap) is born awaiting approval: nothing touches AD until another person approves. The request includes a per-connector preview (which accounts get created, disabled or change role) frozen as a record: what the approver approves is exactly what the requester saw. Only one open move per user.
Where to see them
The approvals monitor lists what's pending; every decision (approve, reject, cancel) is audited with its record and correlation to the executed tasks.