#1181 Multi-party approval for destructive admin actions Issue created by javuto Part of Santa/Workshop parity, building on the Santa sync server from #1142 (

pkg/santa

,

osctrl-tls

sync endpoint, Santa page in the UI). Problem A single compromised admin can disable enforcement (switch to MONITOR, add a broad allow rule, rotate the sync token). Workshop requires a second admin for such actions. Scope • osctrl-wide mechanism, starting with Santa: selected actions create a pending change that another admin must approve. • Configurable per environment; disabling it also requires approval. • Pending changes expire; everything is audited. Acceptance • An admin cannot approve their own pending change. • Covers at least: Santa mode change to MONITOR, environment-wide allow rules, token rotation. jmpsec/osctrl