Skip to main content
OnzliOnzli
Help
Browse Onzli help
Understanding permissions and security

Control modes

Dual control and single-operator mode, and what protects approvals in each.

Last reviewed 25 October 2026

A business approves returns under one of two control modes. Administrators can see and change it under Controls. Changing it needs an authenticator code.

Dual control

The default. Approval is meant to be independent: the person who prepared or resolved a return is not the person who approves it.

Single-operator mode

For when a second reviewer is not available. One person may approve their own calculations, so extra safeguards apply:

  • Attestation. At approval, you type the Box 5 amount to confirm you have read it.
  • Step-up. A fresh authenticator code is needed.
  • Cooling-off. A set number of minutes applies. The number is shown under Controls.
  • Oversight notification. An email goes to the oversight address, which is set under Controls.

While single-operator mode is on, a banner says so on every page. These safeguards are not independent review: switch back to dual control when a second reviewer is available.

If oversight emails fail

A notice appears on pages and in the notifications bell when oversight notifications cannot be delivered. Filing is unaffected, but ask whoever runs the service to check email delivery.

Approve a return

What approval means and what you confirm when you approve.

Roles and permissions

What each role can do, and who can submit to HMRC.