Separation of Duties (SoD)
Security control that prevents a single user from performing conflicting operations. For example, the same person cannot both create and approve a payment — requires two distinct identities.
Separation of Duties (SoD) is a security control that prevents a single user from performing conflicting operations — for example, the same person cannot both create and approve a payment. It enforces dual control by requiring two distinct identities for high-risk workflows.
Static vs dynamic SoD
- Static SoD: predefined conflict sets (e.g., "invoice:create" and "invoice:approve" cannot be held by the same user)
- Dynamic SoD: evaluated at runtime (e.g., the approver of a specific invoice cannot be the same user who created it)
Compliance value
SoD is a requirement for SOX, PCI DSS, and most financial services regulations. Auditors specifically look for enforced SoD controls as evidence of proper access governance.
WardenAuth supports both static and dynamic SoD constraints. Try it free.
Related terms
Authorization that evaluates permissions at the individual resource or action level, rather than broadly by user type or role.
Security principle that every subject should have the minimum access needed to perform its function — and no more. Foundation of zero trust and defense-in-depth architectures.
Immutable, chronological record of every authorization decision — who, what, when, scope, resource, action, and outcome. Enables compliance reporting and incident investigation.