The payout file mounts only when both departments say so

Payout batches leave the payments container from /var/payouts/outbox. The bank-upload job runs in a different container, held by finance. Nobody in engineering can push a file to the bank alone, and nobody in finance can reach into the payments box.

The link is a storage share. Engineering creates it: POST /api/v1/containers/{payments}/storage/shares with the outbox path, the upload container as target, mode: readonly, an expires_at for the quarter. That share is not mounted yet. Finance accepts it from their side: PATCH .../storage/incoming/{shareId}/mount with mount: true. The creator's enabled flag and the receiver's mount flag must both be true, and either side can drop theirs: the directory vanishes from the upload box.

Four-eyes used to be a policy document and a Slack thread. Now it's a mount with two switches.

Segregation of duties is a directory that needs two flags to exist.