Separation of Duties
SoD policies prevent toxic combinations of access that create fraud or security risks
Sensitive Access Conflict
criticalSame person cannot both approve and audit financial transactions
Developer-Production Access
highDevelopers cannot have direct production deployment access
Security Admin Conflict
highSecurity admins should not be able to read audit logs they generate
HR Data Access
mediumHR managers should be separate from payroll administrators
Violation Detection
The DetectSoDViolationsWorkflow Temporal cron workflow scans for conflicting access combinations across all identities.
When a violation is detected, the system flags the identity with a risk factor, triggers a CAEP event, and can auto-revoke the conflicting access if the risk score exceeds thresholds.
SoD rules are evaluated at both access request time (preventive) and periodically (detective) via the Temporal scheduler.