Classic examples separate requesting, approving, and executing payments; developing, reviewing, and deploying code; or creating accounts, granting rights, and auditing their use. In identity and access management it appears as role design, approval workflows, and constraints that prevent one principal from accumulating conflicting powers.
Key points
Genuinely conflicting actionsMap the steps of sensitive processes and split them where one actor could defraud, harm, or silently alter the result.
Technical enforcementEncode constraints in roles, approvals, and systems — a policy document alone does not stop a privileged account.
Important limitationSeparation of duties reduces single-actor risk, not collusion, coercion, or compromised approval chains. It also adds friction and cost, so apply it to the actions where the risk justifies it.