What counts as a distinct approver?
Design multi-approver policies without confusing separate API credentials with separate human reviewers.
Requiring two approvals is only meaningful once you define what makes the approvers distinct. Two API keys held by one operator are not two independent people. A policy that counts credentials should not be described to customers as a two-person control.
Anlyon's N-of-M approval rule counts distinct credentials for API-key deciders and distinct users for dashboard and OAuth deciders. The requesting credential cannot decide its own request. These identity rules matter when you choose how reviewers authenticate.
Choose the identity model first
| Review path | Distinctness to document |
|---|---|
| API keys | Different credentials, even if one person holds both |
| Dashboard users | Different authenticated users |
| OAuth deciders | Different users under the documented identity rules |
If your requirement is independent human review, use identities and operational controls that establish that independence. Do not infer it from a credential count. Likewise, a decision marked as human-origin is not proof that a person clicked a button: the documented category can include an API-key decision.
Design the permission boundary
Keep action invocation separate from approval decision privileges. Inventory who can create decider credentials and who can change the policy. A workflow with multiple reviewers can still have a single administrative actor capable of changing its configuration.
Show the pending operation, required decisions and actual decider identities in your operator view. Preserve the request identifier with each decision. A list of names disconnected from the reviewed request is weak evidence of what was authorized.
Test identity edge cases
In staging, try a repeated decision from the same credential, decisions from two distinct credentials, and an attempted decision by the requester. Also test the relevant dashboard or OAuth route if that is your production path. Inspect the actual decision records instead of assuming all authentication methods share identical identity semantics.
State the result precisely in your own documentation: "two distinct users" only when that is what your deployment enforces. This guide describes implementation behavior, not a certification or legal compliance determination.
Read approval policy configuration and tool permissions. Pair the identity control with a concrete review screen.