Skip to main content
4-eyes review adds a second, independent sign-off before a resolution takes effect, a standard segregation-of-duties control for higher-risk investigations.

​
Setting it up

On the maker blueprint, set 4-eyes review to a checker blueprint. Setting this field is what turns 4-eyes on for the maker blueprint, there is no separate toggle.

​
How it works

  1. An officer on the maker blueprint resolves a case as usual (false positive or valid threat, plus a note if required).
  2. Instead of closing, the case status stays Open, the proposed resolution is staged, and the case moves into the checker blueprint’s queue. The case timeline logs Submitted for approval.
  3. A checker reviews the case’s Overview tab, where a dual-control banner shows Approve and Reject actions.
  4. Approve applies the staged resolution: the case becomes Resolved with the original resolution and note, credited to the officer who submitted it. The timeline logs Approval granted then Resolved.
  5. Reject clears the staged resolution and returns the case to the maker blueprint. The timeline logs Approval rejected, and the maker is notified.
The officer who submitted the resolution cannot approve or reject it themselves, enforced server-side. Attempting to do so returns a 403. (Approving or rejecting a case with no resolution pending approval returns a 409.)

​
When evidence changes

Changing a checklist answer or adding or removing a linked verification or transaction clears the pending decision and returns the case to its original review policy. The activity timeline records that a new review decision is required and preserves the earlier proposal in the audit event. The reviewer must examine the updated evidence and submit a new decision before a second officer can approve it. Repeating the same checklist answer does not cancel a pending review. Approval also checks the linked source evidence against what was submitted for review. A changed verification status, corrected document field, changed transaction evidence, or unavailable source blocks approval with 409. Losing access to global network evidence linked through a Fraud Check also requires a new review. Use Reject to return the case to its maker, review the updated evidence, and submit a new decision. Opening the source record or adding an internal case note does not by itself block an unchanged review. If the submitted evidence cannot be verified, a new review is required before approval.

​
Notes

  • Review requirements are saved when the case is opened. Moving into the checker queue does not replace those requirements with later policy edits.
  • A case can only have one resolution staged at a time; requesting more information (Awaiting user) is blocked while a resolution is pending approval.
  • 4-eyes pairs with required resolution notes: turn both on for your highest-risk blueprints to require both a documented rationale and a second reviewer.