General Alexander: NSA to implement two-man rule for sysadmins

General Alexander mentions that NSA is now in process of implementing a two-man rule for NSA system administrators. At 1:08:10, http://www.c-spanvideo.org/event/220343

    A system administrator is one that actually helps operate/run, 
    set the conditions, the auditing and stuff on a system or portion 
    of the network.

    When one of those persons misuses their authorities this is a 
    huge problem.

    So, working with the director of National Intelligence, what 
    we are doing is working to come up with a two-person rule and 
    oversight for those and ensure that we have a way of blocking 
    people from taking information out of our system.

    This is work in progress. We're working with the FBI on the 
    investigation. We don't have all the facts yet. We've got to get 
    those. And as we're getting those facts, we are working through
    our system.

    Director Clapper has asked us to do that, and providing that 
    feedback to the rest of our community.

Initially I thought it meant something like pair programming. But it seems more like some kind of linux plugins to enable two-factor auth, where sysadmins will need another sysadmin to approve every `sudo`? How else can they implement this?