Rules you define
Express the combinations that matter in your business, rather than accepting a generic template that fits no one.
Toxic combinations blocked before they are granted
Rules evaluated at request time, so conflicting access is prevented rather than discovered at the next audit.
Segregation of duties exists because some pairs of permissions are individually reasonable and dangerous together — raising a payment and approving it, for instance. Zetect evaluates those rules when access is requested, so the conflict is refused or escalated up front instead of appearing in a report months later.
How Segregation of Duties works
The mechanics behind the capability — what the platform does, and where it does it.
Evaluated before the grant
The check runs at request time, which is the only point where preventing the conflict is cheap.
Assessed against total access
The rule considers everything the identity already holds across systems, which is where cross-application conflicts hide.
Visible in reviews
Existing conflicts surface in certification campaigns so historic combinations can be unwound deliberately.
What it changes
Who feels the difference once Segregation of Duties is in place, and how.
Risk
Fraud routes close
The combinations that make internal fraud possible never get assembled in the first place.
Audit
A control auditors recognise
Preventive SoD enforcement is materially stronger evidence than a detective report produced after the fact.
Governance
No awkward unwinding
Removing conflicting access from someone doing their job is far harder than never granting it.
Application owners
Consistent judgement
The same rule applies to every request, rather than depending on which approver happened to see it.
See Segregation of Duties in context
It works because the other capabilities share the same identity fabric. The quickest way to judge that is to watch it run against your own use cases.