The regulatory Maker-Checker rule (Basel, FDIC, SOX): above a threshold, a high-value action needs a second, distinct, authorized human — and the person who proposed it (the maker) can never be their own checker. This kernel enforces it deterministically: allow, needs_approval, or deny. EcoCloud decides who must approve — it never moves the money. Add and remove approvers and watch the gate.
Honest scope. A deterministic, signable governance primitive in the kernel family — the value-tier complement to it is the signing-limit kernel, and a satisfied four-eyes gate is the Auth phase of the Auth·Clear·Settle loop. EcoCloud decides who must approve and that they're distinct + authorized; it does not move money or call the core banking system — the transaction is the connector's, and each approval is an ES256-signed envelope (the "dual signature"). It is a primitive + demo; wiring it onto live high-value task mutations is the next step. Source: flowdesk-foureyes-kernel.js.