Segregation Of Duties Conflict Matrix Checker

Evaluate actual user-role assignment matrix against caller forbidden role pairs, deduplicating symmetric rules and exposing conflict witnesses; no inference about authorization, compensating controls or complete segregation compliance.

Description

Segregation of duties can be tested against forbidden pairs of assigned roles.

Segregation of duties can be tested against forbidden pairs of assigned roles. Conflict witnesses identify both the user and the paired roles.^[1]

The returned values include User and conflicting role triples, Conflicted user indices, No declared role conflicts observed. The How section below explains the calculation, input rules and interpretation.

When to use Segregation Of Duties Conflict Matrix Checker

Use Segregation Of Duties Conflict Matrix Checker when you need to evaluate the supplied records under the calculation and evidence rules below. No authorization validity, compensating-control assessment or complete segregation compliance is inferred.

Gather the source balances and explicit accounting policy. Monetary inputs use integer minor units in one currency; for a currency with 100 minor units per major unit, 12345 represents 123.45. One basis point is 0.01 percentage points; 10000 basis points is 100%. Dates and posting signs follow the individual rules below.

How to use Segregation Of Duties Conflict Matrix Checker and understand its results

Gather the source balances and explicit accounting policy. Monetary inputs use integer minor units in one currency; for a currency with 100 minor units per major unit, 12345 represents 123.45. One basis point is 0.01 percentage points; 10000 basis points is 100%. Dates and posting signs follow the individual rules below.
Enter userRoleAssignmentFlags, callerConflictingRoleIndexPairs using the field table and calculation rules, then run the tool.
Read userAndConflictingRoleTriples, conflictedUserIndices, noDeclaredRoleConflictsObserved. The explanation below defines the units, signs, ordering and any flags or placeholder values.
If the tool reports an input issue, correct the values and run it again. Apply the stated assumptions when interpreting a successfully returned result.

Input field	Meaning	Value type; see rules below	Requirement
userRoleAssignmentFlags	User role assignment flags	list of list of number	Required
callerConflictingRoleIndexPairs	Caller conflicting role index pairs	list of list of number	Required

Enter a nonempty rectangular binary user-by-role matrix and nonempty two-column integer role-index pairs. Require indexes in range and distinct within each pair. Sort each pair and reject repeated symmetric rules. Return zero-based witness triples, each conflicted user once and a no-conflicts flag. More than 128 witnesses produces a resource-limit input issue; narrow the review scope.

witness=[userIndex,roleA,roleB] when both assignments are1

Units, indexing, boundary conditions and exceptional cases are defined in the calculation rules above.

Output field	Meaning	Value type
userAndConflictingRoleTriples	User and conflicting role triples	list of list of number
conflictedUserIndices	Conflicted user indices	list of number
noDeclaredRoleConflictsObserved	No declared role conflicts observed	boolean

json

{
  "input": {
    "userRoleAssignmentFlags": [
      [
        1,
        1,
        0
      ],
      [
        0,
        1,
        1
      ]
    ],
    "callerConflictingRoleIndexPairs": [
      [
        0,
        1
      ]
    ]
  },
  "output": {
    "userAndConflictingRoleTriples": [
      [
        0,
        0,
        1
      ]
    ],
    "conflictedUserIndices": [
      0
    ],
    "noDeclaredRoleConflictsObserved": false
  }
}

Limitations and assumptions

No authorization validity, compensating-control assessment or complete segregation compliance is inferred.

Numeric inputs, where present, must be finite. Follow the calculation-specific rules for overflow, underflow and exceptional cases. Numeric lists are limited to 10,000 entries and string lists to 128 entries of at most 128 characters. Follow any smaller limits above. Matrices are limited to 128 rows and 128 entries per row. Missing fields without a declared default, extra fields, wrong value types and violations of the calculation rules are input errors. A successfully returned false flag is an evaluated outcome; its meaning is explained above.

Alternative or Complementary methods

Use User Access Review Quarterly Recertification Evidence Tester: Access recertification records need a reviewer, decision and supporting evidence within an explicit age allowance. Row flags summarize already reviewed facts. For a complementary task, use Independence Threat Safeguards Classifier: Independence safeguards require both declared implementation and approval. Label coverage alone does not constitute an independence conclusion.

References

Segregation Of Duties Conflict Matrix Checker — tool.io

Similar or alternative tools

User Access Review Quarterly Recertification Evidence Tester
Access recertification records need a reviewer, decision and supporting evidence within an explicit age allowance. Row flags summarize already reviewed facts.
Independence Threat Safeguards Classifier
Independence safeguards require both declared implementation and approval. Label coverage alone does not constitute an independence conclusion.