You are creating a Dual Control workflow for a team’s safe. Which safe permissions must you grant to the Approvers group?

For a user or group to act as an approver in a Dual Control workflow, they require two specific permissions. First, they need the "List accounts" permission to see the accounts within the Safe and view pending requests associated with them. Second, they must have the "Authorize account request" permission, which explicitly grants them the ability to approve or deny those requests. The approver's role is strictly to authorize access for another user; they do not need the ability to retrieve the credentials themselves.

B: "Retrieve accounts" is for the requester, not the approver. "Access Safe without confirmation" is a separate workflow for Safe-level access, not account-level requests.

C: The "Retrieve accounts" permission is incorrect for an approver. This permission allows a user to access the credential, which is the requester's role after approval.

D: The "Unlock accounts" permission is for manually releasing an account locked by the CPM, which is a separate administrative task unrelated to the Dual Control approval workflow.

1. CyberArk Privileged Access Manager - Self-Hosted Documentation v12.6

"Add a Safe member". This section details the specific Safe member authorizations.

List accounts: "View accounts and files in the Safe." This is required for the approver to see the request.

Authorize account request: "Authorize requests for account access made by other users." This is the explicit permission for the approver role.

Retrieve accounts: "Retrieve and view accounts and files in the Safe." This permission is designated for the user who will ultimately use the account after approval.

2. CyberArk Privileged Access Manager - Self-Hosted Documentation v12.6

"Enforce dual control for password access". This document describes the workflow

clarifying that the user who confirms the request (the approver) is distinct from the user who retrieves the password (the requester). The approver's permissions are limited to authorization

not retrieval.