Two-pass verification on a SaaS

The industry and problem

I added a two-pass verification to a SaaS used by a healthcare operations group to manage sensitive account settings. A single confirmation click could delete records or change payout details. I needed a second check that reduced risk and kept daily work moving.

Constraints

• Keep it fast for busy staff on phones and tablets.
• Add no extra app or device. Use channels they already had.
• Support both single sign on and passwords.
• Meet accessibility basics with clear focus order, labels and error messages.
• Provide an audit trail for reviews and incident response.

Two pass means a user confirms a risky action with a separate step, such as a typed phrase or a code. If you handle HIPAA regulated data, confirm specific requirements with your attorney or compliance advisor.

My approach

I mapped critical actions first. That list included destructive deletes, permission changes, payment destination edits and large data exports. Then I matched each action to a two pass pattern that fit the risk.

• Typed confirmation gate. Show a plain summary of the change and require the user to type a short confirm phrase.
• Reauthentication. If the session was old, ask the user to sign in again before proceeding. Single sign on means using one login to access several systems.
• One time code. Send a code to a verified channel such as email or an authenticator app and require that code to continue.
• Two person approval. For the most sensitive changes, require a second authorized person to approve.
• Timed hold. Queue the action for a short window so the requester can cancel if it was a mistake.

I logged who requested and who approved, with timestamps and change details. I set rate limiting, which slows repeated attempts from the same source, and I added firewall rules to reduce automated attacks. I wrote a short procedure so staff knew when to approve and when to escalate.

What I learned

The second check must match the risk, use plain language and be predictable. Small, well placed friction helps people slow down and confirm intent without blocking real work. Test the flow on mobile and with a screen reader, review roles often, and keep a documented emergency bypass for authorized leaders.

How I can help

I design and implement second checks and access controls as part of Security & Compliance > Features & Add-ons, and I can pair them with WAF & Firewall or HIPAA Compliance as needed.