PL

SoD Guard

Segregation of Duties

SAP authorization conflict analysis and role matrix management. It finds where one person can create a vendor and approve their payment — before an auditor does.

In production
The challenge

In a mature SAP system the authorization matrix grows for years. Roles inherit from roles, assignments outlive the people who changed jobs long ago. Reviewing thousands of roles by hand is not feasible, and a spreadsheet stops being enough at the first audit.

How it works

  1. Ingest

    SAP exports are loaded, validated and decomposed into roles, assignments and company codes. No agent in the production system.

  2. Detection

    The SoD engine walks the matrix on two levels — the individual role, and the real user with their full set of authorizations.

  3. Reporting

    Output comes out as XLSX, DOCX, HTML or PDF — in a form an auditor accepts without translation.

  4. AI assist

    An optional Amazon Bedrock module proposes ways to mitigate a conflict. It is a toggle, not a requirement.

What it runs on
  • Aurora PostgreSQL
  • Lambda
  • ECS Fargate
  • Cognito
  • S3
  • Bedrock
Ask about this product← All products