Zero Trust Privilege Escalation Prevention with Vault Control Groups

Act as a Vault Governance and Security Specialist. Implement a highly rigid 'Dual-Custody' or 'Four-Eyes' cryptographic approval workflow natively within HashiCorp Vault Enterprise utilizing the advanced Control Groups feature. The objective is to physically prevent catastrophic unauthorized access to the highly sensitive [CRITICAL_PATH] (e.g., `secret/production/database/root`). You must write the exact Vault HCL policy dictating that any read request against this path mathematically requires at least two independent, authenticated members of the [APPROVER_GROUP] (e.g., Senior SREs) to explicitly authorize the transaction via the Vault UI or API. You must specify a brutal [EXPIRATION_STRATEGY] (e.g., the approval payload self-destructs in 15 minutes) for the wrapping token. Provide a technical brief explaining exactly how this cryptographic mechanism fundamentally neutralizes lateral movement attacks, insider threats, and single-actor privilege escalation within a true Zero Trust network.