Segregation of Duties

The principle is ancient and its application to modern engineering is where the argument happens, because DevOps deliberately gives teams end-to-end ownership and that looks, superficially, like a segregation failure.

The resolution is that segregation applies to the authority to change production, not to the knowledge of how it works. A team can own a service completely and still be unable to unilaterally alter production, provided the pipeline enforces the separation: a developer authors a change, another engineer reviews it, and the deployment mechanism is the only path to production — with no individual holding standing write access to bypass it.

That is a genuinely strong control, and it is often stronger than the manual alternative, because the pipeline cannot be persuaded, is not under deadline pressure, and logs everything.

The controls that make it hold: no human standing production write access, with break-glass access that is time-bound, alerted and reviewed; branch protection that cannot be disabled by the person being reviewed; and the pipeline's own credentials scoped so that CI cannot be used as a bypass.

The failure that auditors find most often is not the design but the exception: an administrator group with permanent production access, containing eleven people, added over three years for reasons nobody remembers.