What is the purpose of the Four Eyes Approval feature?

The Four Eyes Approval feature, officially named Action Approval in HCL BigFix, is a security control mechanism. Its primary purpose is to enforce a two-person approval workflow for deploying actions. This ensures that no single console operator can unilaterally execute a potentially high-impact task, such as deploying a patch or changing a configuration, on managed endpoints. An action proposed by one operator must be reviewed and explicitly approved by a second, authorized operator before it can take effect, thereby enhancing operational oversight and reducing the risk of error or unauthorized activity.

A. Client authentication of actions is managed through the BigFix infrastructure's use of digital signatures to verify the action's origin and integrity, not by this feature.

B. Enforcing password complexity for console operators is a separate user account security policy and is not the function of the Four Eyes Approval feature.

D. The creation and management of BigFix operators, including ensuring uniformity, are handled through user administration and role-based access controls, not the action approval workflow.

1. HCL BigFix Platform V10.0 Administration Guide. In the section "Action Approval

" the guide states

"The Action Approval feature

also known as 'four-eyes approval'

allows you to require that actions are approved by a second BigFix operator before they can be deployed. This feature is useful in environments where you want to prevent a single operator from deploying potentially disruptive actions without a review from another operator." (Reference: Chapter 4: BigFix Management

Section: Action Approval).