Segregation of Duties (SOD)

Overview

Segregation of Duties (SOD) helps organizations prevent users from holding conflicting access privileges that could create security, compliance, or operational risks.

In many organizations, certain combinations of access should never belong to the same user.

For example:

• A user should not both initiate and approve the same transaction
• A user should not belong to conflicting operational groups
• A user should not hold privileged roles that violate internal governance policies

Fixiam allows administrators to define and enforce these access conflict rules using Segregation of Duties policies.

SOD policies can currently be enforced across:

• Application Roles
• User Groups

Once configured, Fixiam automatically detects and prevents conflicting access assignments based on the defined governance rules.

---

Accessing Segregation of Duties

Navigate to:

Settings → Policy Management

The Policy Management page is where administrators configure and manage Segregation of Duties policies.

---

Understanding Segregation of Duties Policies

A Segregation of Duties policy defines two access assignments that should not belong to the same user.

Each policy includes:

---

Supported Policy Scopes

Fixiam currently supports the following SOD policy scopes:

---

Creating an Application Role Conflict Policy

Application role conflict policies help prevent users from receiving conflicting privileges within an application.

Steps

1. Click Create Policy
2. Enter the policy name
3. Select Application Role as the policy scope
4. Select the target application
5. Select the first conflicting role
6. Select the second conflicting role
7. Create the policy

Example

A user should not simultaneously hold:

• Maker
• Approver

Once the policy becomes active, Fixiam automatically prevents users from being assigned both roles.

---

Creating a Group Conflict Policy

Group conflict policies help prevent users from belonging to conflicting organizational groups.

Steps

1. Click Create Policy
2. Enter the policy name
3. Select Group as the policy scope
4. Select the first conflicting group
5. Select the second conflicting group
6. Create the policy

Example

A user should not belong to both:

• Finance Operations Group
• Finance Audit Group

Once active, Fixiam automatically blocks conflicting group assignments.

---

How SOD Enforcement Works

After a policy is activated, Fixiam continuously evaluates user access assignments against configured conflict rules.

Enforcement includes:

• Blocking new conflicting assignments
• Detecting existing conflicts
• Recording policy violations
• Displaying unresolved violations for administrative review

Important Notes

• Enforcement is automatic once a policy is active
• Existing user assignments are also evaluated
• Violations remain visible until resolved

---

Managing SOD Policies

Administrators can manage policies directly from the Segregation of Duties dashboard.

Available actions include:

---

Viewing Violations

The Violations page displays users with conflicting access assignments.

Navigate to:

Any policy from the table → View Violations

The violations dashboard helps administrators identify unresolved governance conflicts across the organization.

Understanding Violation Records

Each violation record includes:

---

Resolving Violations

Administrators can resolve access conflicts directly from the violations page.

Steps

1. Select the affected user
2. Click Remove Conflicting Access
3. Confirm the action

Once resolved:

• Conflicting access is removed
• The violation status is updated
• The activity is recorded for audit purposes
  

---

Activity Tracking and Audit Visibility

Fixiam maintains activity records for Segregation of Duties operations.

Tracked activities may include:

• Policy creation
• Policy activation
• Policy deactivation
• Policy updates
• Violation resolution activities

These records help organizations maintain governance visibility and audit readiness.

---

Best Practices

• Start with High-Risk Access Conflicts-Begin with roles or groups that create the highest governance risk.
• Review Violations Regularly-Monitor unresolved conflicts regularly to maintain compliance.
• Validate Access Structures-Ensure roles and groups are properly structured before enabling enforcement.
• Avoid Duplicate Policies-Avoid configuring overlapping or duplicate conflict rules.

---

Troubleshooting