Reference
Segregation of Duties
The 8 SoD rules the platform tracks (6 enforced today) and the dual-approval policies that back them.
The platform tracks 8 Segregation-of-Duties rules; 6 are enforced in code today. Rules marked registered (not yet enforced) are tracked so the gap stays visible until their enforcing slice ships.
Rules
| Rule ID | Title | Status | Enforcing slice | Source |
|---|---|---|---|---|
sod.role.no_self_modification | Actor cannot modify own role assignments | enforced | IDN-05 | BAIT 5 |
sod.role.auditor_dual_approval | Auditor role assignment requires dual approval | enforced | IDN-05 | DORA Art. 5(2)(g) |
sod.role.audit_read_revoke_forbidden | Cannot revoke audit log read from the auditor role | enforced | IDN-04 | DORA Art. 5; MaRisk AT 4.3.1 |
sod.change.approver_not_requester | Change approver cannot be the change requester | enforced | CHG-02 | MaRisk AT 4.3.1; DORA Art. 5 |
sod.change.approver_not_implementer | Change approver cannot be the change implementer | enforced | CHG-02 | BAIT 5 |
sod.incident.report_author_not_responder | Major-incident regulatory report author cannot be on-call responder | enforced | REP-02 | DORA Art. 19 (intent) |
sod.audit.retention_policy_dual_approval | Audit log retention policy mutation requires dual approval | registered (not yet enforced) | AUD-04 | MaRisk |
sod.role.incompatible_pair_restriction | Configurable role-pair restrictions | registered (not yet enforced) | v2 | BAIT 5 |
Dual-approval policies
Assigning these roles cannot be done directly -- it routes through a request that a second, distinct, eligible approver must clear.
| Role | Min approvers | Eligible approvers | Default expiry | Backing rule |
|---|---|---|---|---|
auditor | 2 | platform_owner, tenant_admin | 72h | sod.role.auditor_dual_approval |
external_auditor | 2 | platform_owner, tenant_admin, compliance_officer | 72h | sod.role.auditor_dual_approval |
works_council_member | 2 | platform_owner, tenant_admin | 72h | sod.role.auditor_dual_approval |