Create separation of duties rules

After you create a separation of duties (SOD) rule, the rule affects all scheduled campaigns and new access requests that a user submits. Active campaigns and access requests that were submitted before the creation of the rule was created aren't impacted.

Before you begin

Sign in as a super admin or an admin with the Manage separation of duties (SOD) risk rules and Manage applications permissions. A custom role must have a resource set that includes the Risk Rules resource type. See Custom admin roles, Role permissions, and Create a resource set.

Create a rule

You can create an entitlement rule for an app that has Governance Engine enabled, or a group rule for an app that doesn't. Each app can have entitlement rules or group rules, but not both.

Create an entitlement rule

  1. In the Admin Console, go to Applications and Resources > Applications.

  2. Find and select the app integration that you want to create an SOD rule for.
  3. Go to the Separation of duties tab.
  4. Click Create rule.
  5. Enter a name, description, and an optional note for the rule. The contents of the note appear in SOD reports, which are useful for auditing purposes. For example, a note stating "This rule was created to meet SOX requirements." documents the purpose of the rule.
  6. Each rule consists of two lists, whose default names are List 1 and List 2. Change the name of a list by clicking the pencil icon, updating the name, and then clicking the checkmark.
  7. For both lists, select either Any one of or All of from their respective dropdown menus.
    • Any one of: The user matches the condition for this side of the rule if they have one or more entitlement value pairs from the list.
    • All of: The user matches the condition for this side of the rule if they have all the entitlement value pairs specified in this list.
  8. For both lists, select the entitlements and their corresponding values to include in the list. Click + Add entitlements to add another entitlement to a list. Each list has a maximum of 50 values across all entitlements.
  9. Click Create rule.

Create a group rule

Use a group rule to prevent a user from being a member of groups that create a conflict. Group rules use the same page as entitlement rules. Group rules apply to groups that are assigned to the app or that are push groups for the app. Each group rule must have at least one group in each list, and the same group can't appear in both lists.

  1. In the Admin Console, go to Applications and Resources > Applications.

  2. Find and select the app integration that you want to create a SOD rule for.
  3. Go to the Separation of duties tab.
  4. Click Create rule.
  5. Enter a name, description, and an optional note for the rule. The name must be unique across group rules. The contents of the note appear in SOD reports.
  6. Each rule consists of two lists, whose default names are List 1 and List 2. Change the name of a list by clicking the pencil icon, updating the name, and then clicking the checkmark.
  7. For both lists, select either Any one of or All of from their respective dropdown menus.
    • Any one of: The user matches the condition for this side of the rule if they are a member of one or more groups in the list.
    • All of: The user matches the condition for this side of the rule if they are a member of all the groups in the list.
  8. For both lists, select the groups to include. Each list has a maximum of 50 groups.
  9. Click Create rule.