The best way is to apply the same conflict logic used for humans, then map each bot or agent to an accountable owner and a bounded set of tasks, tools and data. Segregation of duties should block incompatible actions, such as creating and approving the same transaction, and enforcement should use policy checks at runtime plus revocation when the agent exceeds scope.
Why SoD for bots and agents should look like human SoD, not a separate policy
Segregation of duties works best when the control logic is the same regardless of actor type. If a bot can both create and approve, or submit and release, the control has already failed at the design stage. The practical difference is that bots and agents need explicit task, tool and data boundaries, plus an accountable human owner for exceptions and escalation.
That means SoD should be defined around conflict pairs, not around job titles alone. If one agent can raise a transaction and also approve it, or can request access and then grant it, the control should treat that as an incompatible combination even if the actions are automated. The rule has to be understandable by business control owners, audit, and the platform team that enforces it.
For a broader governance view, NHIMG’s IAM and IGA Basics is useful because it grounds SoD in entitlement design, access reviews and governance of people and machines.
What runtime enforcement must do when a bot or agent is outside its lane
Static assignment is not enough. Runtime policy needs to check the proposed action, the target system, the data being touched and the current session or token context before the action is allowed. That is what turns SoD from a spreadsheet rule into an operational control that can stop an unsafe action before it completes.
Revocation matters just as much as prevention. If an agent drifts beyond its approved scope, the control should remove its access path, not merely log the event for later review. For long-lived or overbroad access, policy must be able to narrow permissions quickly enough that a tasking error does not become a persistent exception.
That is why NHIMG’s Core Security Principles Guide fits this question, because SoD for autonomous actors only works when least privilege and complete mediation are enforced together.
In practice, the control should also separate policy decision from policy execution. A bot can request an action, but the system that approves it should not be the same component that carries it out, especially in finance, HR, procurement or admin workflows where one compromised agent can create fraud or change-impact quickly.
How to scale SoD across many agents without turning it into role chaos
The biggest scaling mistake is to copy human roles directly onto bots and then keep adding special cases. That creates role sprawl, weak accountability and too many exceptions to review. A better model is to define a small number of bounded agent patterns, each with a narrow purpose, a named owner, approved tools, approved datasets and a clear list of forbidden pairings.
That model is easier to govern when change control and SoD are linked. If an agent’s task set, approval path or tool access changes, the change should go through the same approval discipline as any other control-sensitive change. The point is not to slow automation, but to make every expansion of power visible before it becomes normal.
NHIMG’s Change Management Policy Template is a natural companion here because it covers approval, emergency change and bot changes in the same control model.
When the environment includes AI agents, the governance problem becomes more explicit, so NHIMG’s Agentic AI in IAM Operations Guide is also relevant for autonomy levels, human approvals and agent identity governance.
Risk and Threat Considerations
Bot and agent SoD failures are risky because automation can turn a single permissions mistake into repeated, high-speed misuse. If one autonomous actor can both initiate and approve, or can move from request to execution without a separate control gate, the organisation has created a fast fraud path, a fast privilege-escalation path, and a fast error-propagation path.
Failure mechanism: The control breaks when policy is defined only at provisioning time, while runtime action checks are absent or too weak to block incompatible tasks, tool use or data access.
Impact: A compromised or over-scoped bot can complete transactions, alter records or widen access in ways that are harder to detect than human misuse, because the action may look like legitimate automation unless the organisation monitors separation at runtime.
For the threat side, NHIMG’s Know Your Agent (KYA) Guide is relevant because identity, authority and revocation are central to preventing agents from being treated as trusted but unbounded actors.
External guidance also aligns with this risk. The OWASP Agentic AI Top 10 covers identity and privilege abuse, tool misuse and rogue-agent conditions that map directly to SoD failures.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Bots and agents need bounded authority to avoid conflicting actions and excess privilege. |
| NHI-10 — Human Use of NHI | SoD for bots depends on accountable human ownership and exception handling. | |
| Recommendation — Limit each bot’s permissions to the smallest task set that cannot create and approve the same change. Assign every bot or agent a responsible human owner for approvals, exceptions and revocation. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Autonomous actors can abuse delegated authority when approval and execution are not separated. |
| Recommendation — Separate request, approval and execution paths so one agent cannot exercise conflicting powers. | ||
| NIST SP 800-53 Rev 5 | AC-5 — Separation of Duties | This question is directly about extending SoD to automated actors and runtime enforcement. |
| IA-5 — Authenticator Management | Agent access must be revocable when scope is exceeded or authority changes. | |
| Recommendation — Apply separation-of-duties rules to agent actions and block incompatible combinations at runtime. Use short-lived, revocable credentials for agents and remove them immediately when scope changes. | ||
Practitioner Guidance
What to prioritise: Define SoD as incompatible action pairs first, then decide which agent types need those pairs blocked by policy. The control should answer one practical question, can this actor both start and finish the same sensitive process?
What to verify: Confirm that every bot or agent has an owner, a bounded task scope, a bounded tool set and a bounded data scope. If any of those are missing, the SoD design is still incomplete even if the workflow looks automated and well governed.
Decision rule: If a bot or agent can cause material financial, operational or access change, require a separate approval or enforcement path that is not controlled by the same actor. If you cannot separate those paths, treat the design as a control exception, not a normalisation of automation.
Practitioner takeaway: The goal is not to make bots behave like humans, it is to make their authority narrower, more observable and easier to revoke than a human’s when the control boundary is crossed.
Related resources from NHI Mgmt Group
- Guide: Segregation of Duties (SoD) Guide
- How should security teams make NHI best practices usable across the business?
- How should organizations approach the governance of AI agents?
- How can organizations manage unauthorized agents in their systems?
- How should security teams extend segregation of duties controls across cloud procurement apps and ERP environments?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 4, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org