12 March 2026
When dual authorization exists on paper but not on the release screen
A recurring finding in treasury payment hubs: policy binders describe four-eyes release, yet one entitlement role still completes the path alone.
Policy documents often state that every domestic payment above a threshold needs a maker and a separate releaser. During walkthroughs we ask the operator to initiate a sample payment and then watch who can finish the release without a second login.
In several recent engagements the second step was optional for users who held a combined “treasury power” role created during an earlier system migration. The role name sounded senior and helpful. It also collapsed segregation.
A practical check before your next internal test cycle: export users who can both amend beneficiary templates and release batches, then reconcile that list against the control matrix line by line. If the export and the matrix disagree, treat the export as the living truth until proven otherwise.