Separation of Duties

SoD policies prevent toxic combinations of access that create fraud or security risks

Total Rules
4
Critical
1
High
2
Medium
1

Sensitive Access Conflict

critical

Same person cannot both approve and audit financial transactions

Finance ApproverFinance Auditor

Developer-Production Access

high

Developers cannot have direct production deployment access

DeveloperProd Deployer

Security Admin Conflict

high

Security admins should not be able to read audit logs they generate

Security AdminAudit Log Reader

HR Data Access

medium

HR managers should be separate from payroll administrators

HR ManagerPayroll Admin

Violation Detection

The DetectSoDViolationsWorkflow Temporal cron workflow scans for conflicting access combinations across all identities.

When a violation is detected, the system flags the identity with a risk factor, triggers a CAEP event, and can auto-revoke the conflicting access if the risk score exceeds thresholds.

SoD rules are evaluated at both access request time (preventive) and periodically (detective) via the Temporal scheduler.