1

Today, when taking an action on a Segregation of Duties (SoD) conflict (deny or allow), it is not possible to reset the status or delete the line. In my opinion, a validity period would be valuable to be added to the SoD conflicts.


There are scenarios where a request will be made that user B would need to take over some tasks from user A due to e.g. vacation or maternity leave. When user A returns, the allowed SoD conflict should not be active anymore.


Another scenario could be that not user B, but user C will be assigned to replace user A for vacation this year. The SoD conflict for user B will be denied. Next year, user B should be considered to replace user A again.


An enhancement in the SoD conflict handling is needed. Whatever solution will be implemented, time state validity, reset, or deletion, the historical actions should be auditable.

STATUS DETAILS
New

Comments

A

PS. Forgot to mention... Removing the roles from the user causing the conflicts, this is deleting the SoD conflict, but it also deleted the taken action if this needs to be persistent. It also removes all history related to the SoD conflict.

Category: System administration