A structured list of duty pairs or permission combinations that should not reside with the same person. Security and compliance teams use it to identify conflicts, design roles, and validate whether access assignments create segregation gaps. It is the practical starting point for enforcing separation of duties.
What a duty matrix captures
A duty matrix is a practical control artifact, not just a policy list. It turns separation-of-duties rules into a structured view of incompatible duty pairs so reviewers can see which combinations should never sit with the same person, role, or entitlement set.
Its value is in making conflicts explicit. Instead of relying on tribal knowledge about who should not approve, create, and deploy the same change, the matrix provides a baseline for design, review, and exception handling.
How it supports role design and access reviews
Security teams use the matrix to test whether job roles, temporary assignments, or access bundles create segregation gaps. It is especially useful when role design starts to drift from operating practice, because the same control can reveal both obvious conflicts and subtle combinations that emerge only after system consolidation.
In mature programmes, the matrix becomes a shared reference for identity, audit, and application owners. It helps them decide whether access should be split, whether a compensating control is needed, or whether the requested combination is acceptable only for a limited time.
Why duty matrices are stronger than informal review
A duty matrix gives consistency to decisions that would otherwise depend on memory, local custom, or ad hoc approvals. That matters because segregation failures are often created by small permission combinations that look harmless in isolation but become risky when combined across procurement, finance, operations, or privileged administration.
The matrix also improves communication. When business and security teams disagree about access, the matrix makes the conflict visible in concrete terms, which reduces ambiguity and makes exception decisions easier to defend later.
Where the control fits in governance and compliance
Duty matrices sit at the intersection of access governance, auditability, and accountability. They help organisations show that they are not merely granting access, but actively checking for toxic combinations and documenting why certain exceptions were approved.
For organisations with recurring role changes, third-party administration, or shared operational teams, the matrix becomes part of the governance baseline. It is most effective when maintained as a living control, because segregation conflicts change whenever roles, applications, or approval paths change.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-5 — Separation of Duties | Duty matrices define incompatible access combinations for separation-of-duties design. |
| AC-6 — Least Privilege | Duty matrices help avoid role designs that grant excess authority through combined permissions. | |
| AU-6 — Audit Review, Analysis, and Reporting | The matrix supports review of exception paths and conflict evidence during access oversight. | |
| Recommendation — Map toxic duty combinations to AC-5 and prevent conflicting access from residing in the same role. Use AC-6 to trim role bundles so no user retains unnecessary conflicting permissions. Correlate audit evidence with the matrix to detect approved exceptions and unresolved conflicts. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | A duty matrix is part of access-control governance because it structures who may hold which permissions. |
| A.5.18 — Access rights | Duty matrices inform review and restriction of access rights that create segregation gaps. | |
| Recommendation — Use access-control policy to align role design with the matrix and block incompatible combinations. Review access rights against the matrix and remove combinations that create duty conflicts. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | CIS access governance directly covers limiting and reviewing conflicting privileges. |
| Recommendation — Apply CIS-6 to govern role assignments and remediate conflicting entitlements before they accumulate. | ||
Practitioner Guidance
Why practitioners should care: The matrix is only useful if it reflects real workflows, real privilege paths, and real exceptions. If it is copied from a template and never reconciled to how people actually work, it will miss the very conflicts it is supposed to prevent.
Common misunderstanding: A duty matrix is not the same thing as a job description chart or an org chart. It should describe incompatible permissions and authority combinations, including temporary and delegated access, not just formal reporting lines.
Practitioner takeaway: Treat the matrix as a control design tool and an audit evidence source, then keep it aligned to role engineering, access reviews, and exception approvals.
Related resources from NHI Mgmt Group
- How should organisations build a segregation of duties matrix for modern IAM programs?
- How do you know if an AP SoD matrix is actually working?
- How should security teams build a segregation of duties matrix that reflects real access?
- How do you know if a separation of duties matrix is actually working?