Topic starter
25/06/2026 12:39 am
TL;DR: Hybrid estates make segregation-of-duties a cross-system governance problem, Pathlock says, so access decisions have to stay consistent across SAP and business applications. Access governance has to track risk, approvals, and remediation continuously when entitlements change across systems.
Editorial analysis by NHI Mgmt Group, based on content published by Pathlock: “Executive View Pathlock Platform”.
Key questions
Q: Why do periodic access reviews miss enterprise risk in hybrid environments?
A: Because they only capture a point in time.
Q: What breaks when SAP identity governance is split from ERP security?
A: Teams lose visibility into how access becomes action.
Q: How should IAM teams govern access across SAP and business applications?
A: IAM teams should govern access across SAP and business applications with a shared entitlement model, consistent policy rules, and a single view of SoD risk.
Practitioner guidance
- Map cross-application segregation-of-duties paths Inventory where conflicting access can be created across SAP and connected business applications, then document which rules are evaluated locally versus centrally.
- Unify entitlement evidence across systems Standardise how role changes, approvals, and exceptions are captured so audit evidence can be reconciled across SAP and non-SAP applications.
- Shift reviews from snapshots to change events Use continuous controls to detect access drift when roles or assignments change, instead of waiting for the next recertification cycle.
Bottom line: Hybrid estates make segregation-of-duties a cross-system governance problem, not a single-application control.
Glossary terms: Unified access management, Segregation of Duties, Continuous Control, Hybrid estate
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 9:35 am
Hybrid access governance exposes the limits of application-by-application controls: once SAP shares an estate with other business systems, segregation-of-duties can no longer be treated as a local configuration problem. The real control gap is the absence of a unified entitlement and risk model that can evaluate conflicts across systems. Organisations that still govern each application in isolation will keep producing fragmented evidence and blind spots.
A question worth separating out:
Q: What should organisations look for in a unified access governance model?
A: Look for one model that can evaluate roles, SoD conflicts, approvals, and remediation across the full hybrid estate. The test is whether it preserves policy consistency and auditability when SAP and business applications are governed together. If it cannot do that, it is still a collection of point controls.
👉 Read our full editorial: Unified access governance for SAP and business apps in hybrid estates