Segregation of duties

Segregation of duties says certain pairs of capabilities must not meet in one person. The classic examples are financial: creating a supplier and approving payments to it, raising an invoice and signing it off. But the same logic covers engineering (writing code and sole-approving its deploy to production) and data (exporting customer data and deleting the audit log that recorded it). The point is that fraud and serious error should require collusion, not one bad day.

Why it is an entitlement problem

SoD violations are invisible at the level of app seats. Both halves of a toxic combination often live inside one system, or arrive from two systems nobody looks at together, like payroll access from the HR tool plus payment approval in the finance tool. Only a view built on entitlements, across systems, can say "this person holds both halves".

Enforcing it

The control has two parts: rules that name the toxic combinations, and a check that runs against reality: at request time (block the grant that would complete a pair) and continuously (surface pairs that already exist). Written as policies over the graph, SoD stops being an annual audit finding and becomes a condition the estate is held in.