PIM Manager settings · Operations > Guards
Second person for a release
| Key | GuardReleaseSecondPerson |
|---|---|
| Where | Operations > Guards |
| Type | On / off |
| Default | Off |
| Feature | PIM policy changes wait for a SuperAdmin · Community, Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched off. |
What it does
Whether releasing a safety guard needs a second SuperAdmin. A release lets one held engine plan through for one run or until a time (at most 24 hours) -- for example more removals than the per-run removal budget, or more account disables than the circuit breaker allows.
When enabled
When on: a new release is created as pending. The engine will not use it until a different SuperAdmin approves it on the Guards page. The person who created it cannot approve it. The same holds for an approval of removals given in the commit popup: the engine uses it only after a different SuperAdmin approved it on the Guards page. If the setting cannot be read, PIM Manager treats it as on.
When disabled
When off (the default): one SuperAdmin with a reason of at least 10 characters releases a guard alone, and the next matching engine run may use it.
Risk and how to reverse it
Off means a single SuperAdmin can let the engine remove or disable more than the guards normally allow in one run. The switch itself can be turned off by one SuperAdmin. Releases are always audited and bound to the exact plan; a changed plan is held again. Reversible at any time; a release already pending stays pending.
Requires
SuperAdmin to change it. Free (Community) and Pro. Needs at least two SuperAdmins when on.
Recommended
On, when you have two or more SuperAdmins: a release can remove access at scale, so it deserves a second pair of eyes.
Related settings
- Limit: commit removal check GuardLimits.CommitRemoval
- Limit: removal budget GuardLimits.RemoveBudget
- Limit: account-disable circuit breaker GuardLimits.DisableBreaker
- Limit: bulk revoke GuardLimits.BulkRevoke
- Limit: admin account deletes per run GuardLimits.AdminDelete
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack