Topic starter
04/06/2026 6:49 pm
TL;DR: Manual segregation of duties governance breaks down as organizations spread across cloud, SaaS, ERP, and hybrid systems, where permissions change daily and toxic combinations can linger for weeks or months, according to SecurEnds. Automated identity governance is now the practical way to detect conflicts continuously, standardize approvals, and keep audit evidence usable.
Editorial analysis by NHI Mgmt Group, based on content published by SecurEnds: “Automating Segregation of Duties with SecurEnds IGA”.
Key questions
Q: What breaks when segregation of duties is not enforced in identity governance?
A: When segregation of duties is absent, a single identity can create, approve, and audit the same sensitive action.
Q: Why do organizations need automated segregation of duties controls?
A: They need automation because modern estates create too many cross-system access combinations for human review to track consistently.
Q: What signs show that SoD governance is failing in practice?
A: Common signs include users who can both create and approve transactions, admins who review their own privileged activity, recurring access creep, and unresolved toxic entitlement combinations.
Practitioner guidance
- Build a formal SoD conflict matrix Define prohibited access combinations for finance, administration, deployment, and identity workflows so automated checks have a clear policy baseline.
- Move conflict checks into provisioning workflows Evaluate every new request, elevation, or role change before entitlement assignment so toxic combinations are blocked at creation time.
- Prioritize high-risk systems first Start with ERP, financial applications, privileged admin paths, cloud infrastructure, and identity management platforms where SoD failures have the largest impact.
Bottom line: Manual segregation of duties no longer scales when entitlement state changes daily across distributed systems and machine-driven workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
04/06/2026 7:02 pm
Manual SoD governance is a snapshot control in a continuous-change environment. The core failure is not a lack of policy but a mismatch between review cadence and entitlement velocity. Cloud provisioning, temporary elevation, and DevOps change access faster than periodic certification can validate it. The practical conclusion is that SoD now has to operate as a live governance function, not a scheduled compliance exercise.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations automate SoD before expanding identity governance to machine identities?
A: No. SoD automation should be designed to include machine identities from the start because service accounts, APIs, bots, and automation workloads participate in the same entitlement ecosystem as humans. If they are left outside the policy scope, the organisation creates a blind spot where risky access can evade the very governance model meant to prevent it.
👉 Read our full editorial: Manual segregation of duties no longer scales across hybrid identity