Understand separation of duties conflicts
Each separation of duties (SOD) rule consists of two lists that are connected by an AND operator in the formula: List 1
AND
List 2.
The following table lists the conditions for SOD rules where conflicts of interest occur.
| List 1 | List 2 | SOD rule conflict |
|---|---|---|
| Any one of | Any one of | A conflict occurs when a user is assigned one or more entitlement value pairs from both List 1 and List 2. |
| Any one of | All of | A conflict occurs when a user is assigned one or more entitlement value pairs from List 1 and all of the entitlement value pairs from List 2. |
| All of | Any one of | A conflict occurs when a user is assigned all of the entitlement value pairs from List 1 and one or more entitlement value pairs from List 2. |
| All of | All of | A conflict occurs when a user is assigned all of the entitlement value pairs from both lists. |
Group conflicts
A group rule creates a conflict when a user is a member of groups in both lists. The same Any one of and All of logic from entitlement rules applies to group memberships, so the table above describes group conflicts too.
For example, a rule might have List 1 set to Any one of the group Deal desk, and List 2 set to All of the groups Finance and Legal. A user who is a member of Deal desk, Finance, and Legal has a conflict. A user who is a member of Deal desk and Finance, but not Legal, doesn't have a conflict.
When a user is in a conflict, each of the conflicting group memberships is shown as part of the conflict, along with the rule name and risk level.
- Considerations and limits
- Guidance when using Entitlement Management.
- Get started with Entitlement Management
- Use this topic when you set up Entitlement Management for the first time.