I'm not an expert in security, but I'd like to put my two cents here.
Let's think on this example:
Bob and Alice have access to your system, and they can each perform certain actions without consulting each other. However, there are some actions for which both need to agree. Either Bob or Alice can request the action, but this will only be executed if both agree on it.
Example: To delete a row from a database table, both Bob and Alice must authorize the action.
Let's say that Bob wants to delete row 1 from the table. Bob access the system with his credentials and issue the transaction request. This transaction would be enqueued, awaiting for Alice to either authorize or deny this action. Later, Alice access the system with her credentials, and the first thing she sees is a notification: "Bob wants to delete row 1 from the database. Do you agree with this?". She could answer yes or no. If she answers "No", the transaction is cancelled, and if she answers "Yes", the transaction is executed.
Notice that this setup requires some things:
- User accounts (individual logins)
- Group accounts (groups of users)
- Transactions available for each user (which can be executed without any further authorization)
- Transactions available for each group (which need the authorization from all members of the group to be executed)
I've seen something close to this at my workplace: The HR administration system, which (among other things) we use to set goals for each year, has workflows that require that many users agree on certain operations. A user triggers an action, and another user (with higher privileges, or with the same privileges but in another branch of the hierarchy) must authorize this action (add a goal, remove a goal, edit a goal, etc.).
Notice that, at the end of the day, this setup is only as secure as the "weakest link in the chain", because once the last user of a group agrees on the action, it becomes irreversible. In our example, if Alice simply clicks "Yes" without reading the notification in full, the row in the table will be deleted and there may not be any rollback option.