Declare
Describe both conflicting sides independently of one target.
Prove & operate · Toxic combinations across systems
Declare a conflict once and find it wherever it occurs.
SoD rules compare condition pairs across the full entitlement estate. Dry-run previews expose violations before activation, and every finding names both sides and the path by which the person received them.
What changes
Segregation of duties
- 01Cross-system toxic combinations
- 02Dry-run before activation
- 03Pre-flight checks on access requests
- 04Identity risk and inbox integration
How it works
Three moves.
One governed loop.
Each move leaves a reason behind for the next one.
Evaluate
Find every identity holding both, however access was inherited.
Resolve
Keep the human choice of which side to remove.
The claim we will defend