Suppose I'm designing a system where I want to make sure that no single user who goes rogue can commit a malicious action. (I'm ducking the question of how two or more users could collude.) And I assume the machine is physically secure.
One possibility would be to require that the admin logon password be split between two people -- one person types in the first 10 characters, the second person types in the second 10 characters. Account protocol dictates that any user who has a portion of the password can be responsible for actions committed from that account -- i.e., once the pair log in, both of them have to stay there and babysit each other until they log off from the account. (Because it's annoying to require two people to be present, the overall architecture should be designed to require the minimum number of actions to be carried out from this privileged account, which is good design anyway.)
One problem is that this is brittle -- if one user becomes available, the whole account is inaccessible.
So, instead, the operating system can split the administrator account between 3 usernames, each with their own username and password. The admin login screen presents 2 username/password forms, and to access the admin account, 2 out of 3 of those users have to enter their credentials. This retains the property that no single user going rogue can access the admin account, but it also means that the account can still be accessed if 1 of the 3 users is unavailable.
This seems like a useful feature. Does it have a name? Does any operating system implement anything like this?
(I realize that things get complicated if, for example, you have an encrypted folder on the hard disk, which most systems handle by encrypting the folder in a way that incorporates the user's password as part of the decryption key. If you want to make sure that the encrypted folder can be decrypted whenever 2 out of 3 users log in, but that no user by themselves can decrypt the folder with their password even if they have access to the data on the hard disk, then you need to encrypt it using a secret-sharing scheme such that 2 out of 3 secrets are enough to decrypt it but 1 is not. This is, however, still doable.)