Topic starter
24/07/2026 4:08 pm
TL;DR: Traditional separation of duties checks can miss toxic access combinations that span ERP, SaaS, cloud, API, automation, and AI-driven workflows, leaving organisations compliant in each system yet exposed across the full process, according to Saviynt. The real control problem is business-process-centric governance: access review, entitlement visibility, and remediation must follow the transaction, not stop at the application boundary.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “Why Traditional SoD Controls Miss Modern Access Risk”.
Key questions
Q: What breaks when SoD is checked only inside one application?
A: Cross-application duty conflicts stay invisible.
Q: Why do cross-application access combinations create fraud risk?
A: Because two valid permissions can combine into one unsafe outcome.
Q: What are the signs that cross-application SoD is failing?
A: Look for clean system-by-system reviews that still leave unresolved transaction risk, fragmented audit evidence, and identities that can influence multiple steps in the same process.
Practitioner guidance
- Map the full business process Identify the systems, roles, integrations, and approvals that make up one sensitive workflow before writing SoD rules.
- Correlate entitlements across systems Review vendor creation, payment approval, employee record changes, payroll access, and similar combined permissions as one access pattern.
- Bring non-human identities into scope Include service accounts, API integrations, bots, and AI agents in ownership, review, and remediation workflows.
Bottom line: Cross-application SoD exposes a governance gap that single-system controls cannot close.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
24/07/2026 4:14 pm
Cross-application SoD is a process-governance problem, not an application-governance problem: The dangerous condition is not excessive access inside one system, but a lawful combination of permissions spread across the systems that execute one business process. That means audit readiness depends on correlated visibility across the transaction path, not a checklist of system-level approvals. Practitioners need to judge entitlement risk in the workflow, not the application silo.
A few things that frame the scale:
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
A question worth separating out:
Q: How should teams govern SoD across human and non-human identities?
A: Govern the workflow, not just the person. Every identity that can alter, approve, or route a sensitive transaction should be in scope, including service accounts, API integrations, bots, and AI agents. The review model needs one ownership chain, one entitlement picture, and one remediation path across all participating identities.
👉 Read our full editorial: Cross-application SoD exposes a governance gap in modern IAM