Separation of duties
In short: Separation of duties is the rule that no single person or system should both request and approve a sensitive action. It is a long-standing audit expectation for finance and access changes. For agents, it means an agent never approves its own request and approvers differ from requesters.
Which controls use this term?
- GOV-08No self-approval. Prevent any agent from approving its own action, and prevent the person who requested an action from being its only approver.
- GOV-20Change management for agent permissions. Treat changes to an agent's permissions, tools or policies as changes that need a ticket, a reviewer and a record.
Which terms are related?
Reviewed by The Register desk