TL;DR: Manual segregation of duties governance breaks down as organizations spread across cloud, SaaS, ERP, and hybrid systems, where permissions change daily and toxic combinations can linger for weeks or months, according to SecurEnds. Automated identity governance is now the practical way to detect conflicts continuously, standardize approvals, and keep audit evidence usable.
At a glance
What this is: This is an analysis of why manual segregation of duties fails in hybrid identity environments and how automation changes conflict detection, approvals, and audit readiness.
Why it matters: It matters because IAM, IGA, PAM, and NHI teams need one governance model that can keep pace with daily entitlement change across human and non-human identities.
Context
Segregation of duties is the control that prevents one identity from controlling a risky process end to end, such as creating and approving payments or requesting and approving privileged access. In hybrid identity environments, that control fails when entitlement change is continuous and governance is still periodic.
The article argues that cloud, SaaS, ERP, DevOps, and machine identities create more access combinations than manual review can reliably track. For IAM and IGA teams, the problem is not the policy itself but the review cadence, evidence collection model, and cross-system visibility behind it.
Key questions
Q: What breaks when segregation of duties is not enforced in identity governance?
A: When segregation of duties is absent, a single identity can create, approve, and audit the same sensitive action. That removes independent oversight and makes fraud, unauthorized changes, and compliance failures much easier to hide. The most dangerous failures usually appear as conflicting permissions across finance, HR, IAM, and privileged access workflows.
Q: Why do organizations need automated segregation of duties controls?
A: They need automation because modern estates create too many cross-system access combinations for human review to track consistently. Automated SoD controls evaluate entitlements continuously, apply the same policy standard across applications, and reduce the delay between access change and conflict detection. That is what makes governance scalable in hybrid identity environments.
Q: What signs show that SoD governance is failing in practice?
A: Common signs include users who can both create and approve transactions, admins who review their own privileged activity, recurring access creep, and unresolved toxic entitlement combinations. If those patterns appear across ERP, cloud, or IAM systems, the control is probably being managed as a periodic review exercise rather than an enforced governance rule.
Q: Should organisations automate SoD before expanding identity governance to machine identities?
A: No. SoD automation should be designed to include machine identities from the start because service accounts, APIs, bots, and automation workloads participate in the same entitlement ecosystem as humans. If they are left outside the policy scope, the organisation creates a blind spot where risky access can evade the very governance model meant to prevent it.
Technical breakdown
Why manual SoD reviews collapse across hybrid identity
Manual segregation of duties depends on a stable permission state, a known reviewer, and a review cycle that finishes before access changes again. In cloud and SaaS environments, those assumptions break because provisioning, temporary elevation, API integrations, and DevOps workflows can change entitlements daily. Spreadsheets and periodic certifications can record a snapshot, but they do not continuously evaluate whether a new access path creates a toxic combination. That makes the control inherently lagging in distributed estates, especially where human users and machine identities share the same business systems.
Practical implication: Replace snapshot reviews with continuous entitlement evaluation tied to policy.
How automated SoD enforcement detects toxic combinations
Automated SoD tools compare identity, role, and entitlement data against a defined conflict matrix. The engine looks for combinations such as create and approve payments, assign and audit privileged roles, or deploy and administer production systems. Once a conflict appears, the workflow can flag it, route approval, or trigger remediation before the access is broadly reused. The technical shift is from after-the-fact review to policy evaluation at the point of entitlement change, which is the only place where fast-moving hybrid estates can be governed consistently.
Practical implication: Evaluate new access against conflict rules before permissions are granted.
Why cross-platform visibility is the real SoD control plane
SoD governance fails when each application holds only part of the identity picture. A conflicting access path may span an identity provider, an ERP system, a cloud account, and a privileged admin role, so no single system can prove the risk on its own. Automated governance platforms normalize those signals into one view of identity and entitlement state, then use that view to produce approval history, remediation history, and audit evidence. Without that aggregation layer, the organisation can have policies on paper but no enforceable model across the full access estate.
Practical implication: Centralize identity and entitlement data before expecting SoD policy enforcement to work.
Breaches seen in the wild
- Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Manual SoD governance is a snapshot control in a continuous-change environment. The core failure is not a lack of policy but a mismatch between review cadence and entitlement velocity. Cloud provisioning, temporary elevation, and DevOps change access faster than periodic certification can validate it. The practical conclusion is that SoD now has to operate as a live governance function, not a scheduled compliance exercise.
Machine identities expand the SoD problem beyond human workflow design. This article rightly includes service accounts, APIs, bots, and automation workloads because they participate in the same entitlement ecosystem as people. That broadens the conflict surface beyond manager approval and into workload governance, where lifecycle, ownership, and access boundaries must be explicit. Practitioners need one policy model that covers both human and non-human execution paths.
Identity and access governance is becoming the control plane for SoD enforcement. When identity data is fragmented across SaaS, ERP, cloud, and on-premise systems, conflict detection is only as good as the consolidated entitlement view. The governance lesson is that manual reconciliation cannot scale to modern estates. Teams should treat central visibility as the prerequisite for any defensible SoD programme.
Audit evidence is now an output of governance automation, not a side task. The article is strongest when it connects SoD controls to compliance readiness because regulators do not care how hard the evidence was to gather. If access review history, remediation tracking, and approval logs are not generated continuously, the organisation is left proving control retrospectively. The practical implication is to design evidence generation into the control itself.
Hybrid identity governance exposes a runtime governance gap. The named concept here is the gap between where access is decided and where it is used. In distributed environments, entitlement risk emerges at provisioning time but becomes visible only later if reviews are manual. That means practitioners should focus on governable decision points, not just on downstream certification.
From our research library:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- Read next: NHI Lifecycle Management Guide
What this signals
Runtime SoD is the new governance baseline: Manual certification cannot keep pace with entitlement churn in cloud, SaaS, ERP, and DevOps estates. The governance model now has to inspect access at the point of change, not after the next review cycle, or toxic combinations will keep reappearing in the same operational gap.
Hybrid identity programmes should treat centralized entitlement visibility as a prerequisite control, not a reporting convenience. Without one reconciled view of human and non-human access, neither conflict detection nor audit evidence is reliable enough to sustain a defensible SoD programme.
For practitioners
- Build a formal SoD conflict matrix Define prohibited access combinations for finance, administration, deployment, and identity workflows so automated checks have a clear policy baseline.
- Move conflict checks into provisioning workflows Evaluate every new request, elevation, or role change before entitlement assignment so toxic combinations are blocked at creation time.
- Prioritize high-risk systems first Start with ERP, financial applications, privileged admin paths, cloud infrastructure, and identity management platforms where SoD failures have the largest impact.
- Centralize identity and entitlement visibility Consolidate access records, approval history, and remediation status across cloud, SaaS, ERP, and on-premise systems before enforcing automated policy.
- Include non-human identities in governance scope Apply the same SoD policy logic to service accounts, APIs, bots, and automation workloads so machine-driven access cannot bypass review.
Key takeaways
- Manual segregation of duties no longer scales when entitlement state changes daily across distributed systems and machine-driven workflows.
- The practical risk is not just policy failure but delayed conflict detection, access creep, inconsistent approvals, and audit evidence that is hard to assemble.
- Automated identity governance turns SoD into a continuous control by checking entitlements, routing approvals, and preserving evidence as access changes.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | SoD automation in hybrid identity depends on disciplined account and access lifecycle control. |
| Recommendation — Use CIS-5 to tighten account ownership, review, and deprovisioning around conflicting access paths. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about continuously governing permissions and entitlements across hybrid systems. |
| Recommendation — Apply PR.AA-05 to enforce and monitor access permissions against SoD policy across connected environments. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article explicitly includes machine identities and risky access combinations that can widen privilege beyond need. |
| Recommendation — Review machine identity entitlements for overprivilege and remove access that creates toxic combinations. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | SoD conflicts often arise when identities accumulate permissions beyond their functional need. |
| Recommendation — Apply AC-6 to restrict access so no identity can both request and complete the same sensitive process. | ||
| MITRE ATT&CK | TA0004;TA0040 — Privilege Escalation; Impact | Excessive access and conflicting privileges can enable escalation and downstream business impact. |
| Recommendation — Map toxic access combinations to TA0004 and TA0040 to prioritize high-impact entitlement conflicts. | ||
Key terms
- Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
- Toxic Access Combination: A toxic access combination is a set of permissions that becomes dangerous when granted together, even if each entitlement looks acceptable on its own. In identity governance, these combinations matter because they can enable misuse, separation-of-duties failures, or broader compromise.
- Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
- Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 4, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org