TL;DR: Segregation of duties conflicts arise when individually valid permissions combine to remove separation between action and approval, allowing errors or fraud to move through finance, HR, IAM, and privileged workflows without independent review, according to SecurEnds. The real issue is not missing policy but access growth outrunning control enforcement.
At a glance
What this is: This article explains how SoD conflicts form when separate permissions become dangerous only in combination, not individually.
Why it matters: It matters because IAM, IGA, PAM, and business-system owners need to detect conflicting access before users can complete unchecked transactions or privilege changes.
Context
Segregation of duties conflicts are an identity governance problem, not just a policy problem. The control fails when access changes outpace review, so permissions that looked reasonable at issue time later combine into toxic combinations inside finance, HR, IAM, and privileged workflows.
In practice, the issue is cumulative. Role changes, temporary approvals, manual provisioning, and emergency exceptions create overlap that is hard to notice in single-system reviews, but easy to exploit or miss once a user can act, approve, and finalise the same process.
Key questions
Q: What breaks when segregation of duties is not continuously monitored?
A: Toxic combinations can persist unnoticed in privileged, financial, and regulated-data workflows. Without continuous monitoring, organisations often detect violations only after a transaction, audit finding, or incident. The result is delayed remediation, weaker accountability, and a higher chance that one identity can control both sides of a sensitive process.
Q: Why do toxic identity combinations create more risk than the same permissions viewed separately?
A: Toxic combinations increase risk because two or more legitimate permissions can interact in ways that unlock outcomes neither permission would create alone. That can bypass least privilege, widen access paths, and turn modest weaknesses into full compromise. The danger is not the individual entitlement, but the combined access pattern across systems, roles, and controls that attackers can exploit once those permissions coexist.
Q: How do security teams detect SoD conflicts before they cause damage?
A: By comparing live entitlements against a current conflict matrix and scanning for overlapping permissions across systems, not just within one application. The most effective programmes focus first on high-risk workflows such as payments, payroll, account creation, and privileged administration, then automate checks inside the request and certification process.
Q: When should organisations use compensating controls instead of immediate separation?
A: Only when the overlap is temporary and business operations cannot pause. In that case, additional review, logging, and approval checkpoints can reduce exposure until the conflicting access is removed. Compensating controls do not solve the SoD problem, but they can limit damage when a full role split is not immediately possible.
Technical breakdown
How toxic combinations form across business workflows
An SoD conflict appears when two or more permissions that should be separated land on the same identity. The individual rights may all be valid, but the combination removes the control boundary that forces independent review. That is why create-and-approve, request-and-approve, or create-and-post patterns are risky. The technical issue is not the presence of access alone. It is the absence of a second trust decision between steps that should never collapse into one execution path. In IAM terms, provisioning logic and business process design have drifted apart.
Practical implication: Treat SoD as a relationship problem between permissions, not a list of isolated entitlements.
Why access creep defeats SoD matrices
SoD matrices only work when they reflect current workflows, current roles, and current exceptions. In many environments, the matrix becomes stale while access keeps moving through role changes, temporary approvals, and manual fulfilment. That creates silent accumulation: old permissions remain in place after a move, and new permissions are added without removing the old ones. Manual spreadsheets and email-based approvals make the problem worse because they rarely preserve full context or reconcile the complete entitlement picture across systems. The result is a conflict that looks valid in isolation and invisible in aggregate.
Practical implication: Reconcile role changes and temporary access against the conflict matrix continuously, not just during periodic reviews.
How IAM and IGA controls surface toxic access patterns
Detection depends on seeing the full combination of entitlements across applications and workflows. IAM and IGA tools help because they can compare assigned access against a defined conflict model and flag overlaps when they appear. In high-risk systems such as finance, HR, ERP, and privileged access layers, the signal is stronger because the business impact of combined permissions is immediate. Reviews still matter, but reviews are retrospective. Automated checks move the control point into provisioning, which is where SoD can be blocked before the overlap becomes operational.
Practical implication: Push conflict checking into provisioning and certification workflows so violations are stopped before they become active.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
- Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Segregation of duties breaks when access governance treats permissions as independent facts instead of dependent combinations. That is the core design failure behind toxic combinations. A create permission and an approve permission may each be legitimate, but together they remove the separation that makes review meaningful. Practitioners should stop thinking only in terms of entitlement count and start evaluating whether the identity can complete a controlled process alone.
Access creep is the operational mechanism that turns SoD policy into SoD theatre. Role moves, temporary exceptions, and manual provisioning let conflicting access persist long after the original business need has changed. The matrix may still exist, but if it is not refreshed against live entitlements, it becomes a record of intent rather than a control. The practitioner takeaway is that SoD governance must be tied to access lifecycle events, not annual reconciliation alone.
High-risk workflows demand control separation at the process layer, not just the account layer. Finance, HR, IAM, and privileged access all expose the same pattern: one identity can push a transaction from initiation to finalisation when segregation is weak. That is a governance failure because it eliminates the independent checkpoint the business assumes is present. Teams should treat process separation as a control objective in its own right.
SoD is a lifecycle discipline, not a one-time rule-set. Access request, role change, emergency grant, and offboarding all need to preserve separation between incompatible functions. When that lifecycle is not governed, toxic combinations become a normal side effect of otherwise reasonable operational convenience. The practical conclusion is that identity governance must track how privileges evolve, not only whether they were initially approved.
What this signals
SoD conflicts are easiest to miss when teams manage entitlements as isolated approvals rather than as process chains. The governance gap is not lack of permission review, but failure to model how initiation, approval, and finalisation interact across systems. For practitioners, that means lifecycle events and workflow design need to be evaluated together.
Identity governance programmes need a live incompatibility model, not a static policy document. A stale SoD matrix can describe intent while access reality moves on through role changes, exceptions, and manual workarounds. Teams should treat conflict logic as a continuously maintained control asset, not a once-a-year compliance artifact.
For practitioners
- Define and maintain an SoD conflict matrix Map incompatible role and action pairs for your finance, HR, ERP, IAM, and privileged workflows, then keep the list aligned to how processes operate today.
- Move conflict checks into provisioning Block or flag toxic combinations during access request and approval flows instead of waiting for periodic reviews to discover them later.
- Review high-risk systems first Prioritise ERP, payroll, HR, and privileged admin paths where a single identity can otherwise complete end-to-end transactions without oversight.
- Remove excess access after role changes Reconcile mover events, emergency grants, and temporary approvals so old permissions are removed when they no longer match current duties.
Key takeaways
- SoD conflicts are combination failures, where individually valid permissions become risky when the same identity can both act and approve.
- The article’s examples show that finance, HR, IAM, and privileged workflows are the most common places where toxic combinations accumulate.
- The durable fix is lifecycle governance tied to live provisioning, certification, and role change events, not just periodic manual review.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | SoD conflicts are about conflicting access permissions and entitlements across workflows. |
| Recommendation — Apply PR.AA-05 to detect and prevent incompatible entitlements from coexisting in the same identity. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account lifecycle drift is a primary source of overlapping access in SoD failures. |
| Recommendation — Use CIS-5 to remove conflicting access when roles or responsibilities change. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | SoD violations often emerge when excess access remains after the original need has passed. |
| Recommendation — Enforce AC-6 so no user retains permissions that let them perform incompatible actions. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Temporary and role-based access that is not removed creates the same overlap problem in identity governance. |
| NHI-05 — Overprivileged NHI | The article’s toxic combinations mirror over-privileged access where one identity can complete too much of a process. | |
| Recommendation — Remove stale entitlements promptly to prevent offboarding gaps from creating toxic combinations. Audit for overprivileged access paths that combine creation, approval, and posting rights. | ||
Key terms
- Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
- Toxic Risk Combinations: Toxic risk combinations are unsafe interactions between datasets, access permissions, and AI workflows that only become problematic when combined. Individually they may appear harmless, but together they can expose sensitive information, enable re-identification, or create unintended inferences that traditional controls may miss.
- Conflict Matrix: A conflict matrix is a working list of permissions or roles that must not coexist within the same identity. It is used by IAM and IGA teams to detect and block risky combinations during provisioning, recertification, and access change events.
- Compensating Control: A compensating control is a measure that reduces risk when the ideal fix, such as immediate patching or redesign, is not possible. In OT, compensating controls often include session recording, access restriction, and tighter monitoring. They do not eliminate the underlying issue, but they narrow exposure until safer remediation can happen.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 6, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org