Topic starter
04/06/2026 6:49 pm
TL;DR: Daily entitlement changes across cloud, SaaS, ERP, and hybrid systems make segregation of duties hard to police by hand, according to SecurEnds. Identity governance needs continuous checks to catch conflicts sooner, standardize approvals, and keep audit evidence usable.
Editorial analysis by NHI Mgmt Group, based on content published by SecurEnds: “Automating Segregation of Duties with SecurEnds IGA”.
Key questions
Q: Why do organizations need automated segregation of duties controls?
A: They need automation because modern estates create too many cross-system access combinations for human review to track consistently.
Q: What signs show that SoD governance is failing in practice?
A: Common signs include users who can both create and approve transactions, admins who review their own privileged activity, recurring access creep, and unresolved toxic entitlement combinations.
Q: What breaks when segregation of duties is not enforced in identity governance?
A: When segregation of duties is absent, a single identity can create, approve, and audit the same sensitive action.
Practitioner guidance
- Build a formal SoD conflict matrix Define prohibited access combinations for finance, administration, deployment, and identity workflows so automated checks have a clear policy baseline.
- Move conflict checks into provisioning workflows Evaluate every new request, elevation, or role change before entitlement assignment so toxic combinations are blocked at creation time.
- Prioritize high-risk systems first Start with ERP, financial applications, privileged admin paths, cloud infrastructure, and identity management platforms where SoD failures have the largest impact.
Bottom line: Manual segregation of duties no longer scales when entitlement state changes daily across distributed systems and machine-driven workflows.
Glossary terms: Segregation of Duties, Toxic Access Combination, Access Certification, Machine Identity
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 19 hours ago by NHI Mgmt Group
04/06/2026 7:02 pm
Manual SoD governance is a snapshot control in a continuous-change environment. The core failure is not a lack of policy but a mismatch between review cadence and entitlement velocity. Cloud provisioning, temporary elevation, and DevOps change access faster than periodic certification can validate it. The practical conclusion is that SoD now has to operate as a live governance function, not a scheduled compliance exercise.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations automate SoD before expanding identity governance to machine identities?
A: No. SoD automation should be designed to include machine identities from the start because service accounts, APIs, bots, and automation workloads participate in the same entitlement ecosystem as humans. If they are left outside the policy scope, the organisation creates a blind spot where risky access can evade the very governance model meant to prevent it.
👉 Read our full editorial: Manual segregation of duties no longer scales across hybrid identity