When procurement workflows are split, segregation of duties reviews can miss conflicts that emerge across systems rather than inside one application. A user may have innocuous access in each platform but still be able to initiate, approve, and complete a risky transaction across the full process. That is a common control gap in hybrid estates.
Why This Matters for Security Teams
When procurement is split across ERP and multiple cloud applications, the control problem stops being a single-application permission review and becomes a process-level identity problem. A buyer may be harmless in one system, approver in another, and fulfillment operator in a third, yet still complete a transaction end to end. That is why segregation of duties reviews often miss conflicts in hybrid estates, especially when teams rely on local role catalogs instead of process-aware controls.
This gap matters because procurement touches spend, vendor onboarding, contract changes, and sometimes payment release. If identity governance is not aligned across platforms, the organisation can create hidden paths for fraud, policy bypass, or unauthorised vendor actions. Current guidance in the NIST Cybersecurity Framework 2.0 and NHIMG research on The 2024 Non-Human Identity Security Report both point to the same operational issue: access must be governed across the full workflow, not just inside each application boundary. In practice, many security teams discover this only after an invoice, vendor master, or approval chain has already been abused.
How It Works in Practice
The practical failure mode is that each platform enforces its own permissions, but none of them understands the full procurement journey. ERP may control purchase order creation, a cloud procurement app may manage approvals, and a SaaS finance tool may release payment or reconcile the vendor record. If the same person, service account, or delegated agent can move between those steps, then an apparently low-risk entitlement in each system can combine into a high-risk end-to-end capability.
Security teams should map the workflow first, then test identity paths across systems. The useful question is not only “who can approve here?” but “who can initiate, modify, route, and complete this transaction across all tools?” That usually means correlating ERP roles, cloud IAM, delegated admin rights, and service-to-service credentials. The The 2026 Infrastructure Identity Survey found that 35.6% of organisations cite consistent access across hybrid and multi-cloud environments as their top NHI security challenge, which matches the operational reality of procurement sprawl.
- Inventory every procurement step, including exceptions, overrides, and manual handoffs.
- Link each step to the human, service, or agent identity that can perform it.
- Test for toxic combinations across systems, not just within one role model.
- Use policy-as-code or continuous controls to evaluate the full transaction context at runtime.
- Prefer short-lived, task-scoped access for approvals, vendor updates, and payment actions.
Where this guidance breaks down is in heavily customised ERP estates with bespoke approval routing, because local exceptions and shadow workflows often defeat clean cross-system mapping.
Common Variations and Edge Cases
Tighter workflow controls often increase operational overhead, requiring organisations to balance fraud prevention against process speed and exception handling. That tradeoff becomes more pronounced when procurement is regional, highly automated, or partially run by external service providers. Best practice is evolving, but there is no universal standard for how to model every procurement exception across ERP and SaaS platforms.
Some environments also include non-human identities such as integration accounts, RPA bots, or procurement agents that act across systems. Those identities can be even harder to govern than people because they operate at machine speed and often inherit broad privileges. NHIMG research on the NHI security maturity gap shows that many organisations still rely on static access patterns despite hybrid complexity, and that weakness is visible in real incidents such as the Snowflake breach and the GitHub Action tj-actions Supply Chain Attack, where identity and secret misuse amplified downstream impact. The control lesson is simple: if a workflow can span systems, the risk review must span systems too.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 | Cross-system role sprawl often stems from poor credential lifecycle control. |
| OWASP Agentic AI Top 10 | A1 | Procurement agents can chain actions across tools without obvious human-like limits. |
| CSA MAESTRO | IA-2 | Agent and workflow identity assurance is central when procurement spans multiple apps. |
| NIST CSF 2.0 | PR.AC-4 | Split procurement workflows demand enterprise-wide access governance, not app-local reviews. |
| NIST AI RMF | AI risk management applies when autonomous agents participate in procurement workflows. |
Review procurement NHI access lifecycles and replace standing credentials with task-scoped issuance.
Related resources from NHI Mgmt Group
- What breaks when cloud exposure data is split across multiple products?
- Should organisations modernise ERP governance before moving systems to cloud applications?
- How should security teams manage cloud identities across multiple applications?
- What breaks when privileged access is split across multiple tools and platforms?
