> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Segregation of Duties in UARs

## Segregation of Duties (SoD) in Access Reviews

### What is Segregation of Duties (SoD)?

Segregation of Duties (SoD) is a foundational principle in internal controls—especially for organizations subject to compliance frameworks like SOX. The goal: no single user should have too much access across critical systems, which could lead to fraud, errors, or data breaches.

With Lumos, you can define and enforce SoD rules by identifying toxic combinations of roles or permissions that should not coexist—across or within applications.

***

## Defining SoD rules

To create a new SoD rule:

1. Click **Add New Rule**.

   <img src="https://mintlify.s3.us-west-1.amazonaws.com/lumos-primary/images/kb/access-reviews/preparing-and-completing-an-access-review/segregation-of-duties-in-uars/66f250e907eb-a84855c7-648f-4a4a-b3b3-115b7fbfa78d2F1743515547291-step1.webp" alt="step 1.webp" />

   <img src="https://mintlify.s3.us-west-1.amazonaws.com/lumos-primary/images/kb/access-reviews/preparing-and-completing-an-access-review/segregation-of-duties-in-uars/d7516da81921-a84855c7-648f-4a4a-b3b3-115b7fbfa78d2Feccb071d-ca63-4913-902.webp" alt="step 2.webp" />
2. Name the rule and optionally add a description to clarify its purpose and impact.

   <Frame>
     <img src="https://mintlify.s3.us-west-1.amazonaws.com/lumos-primary/images/kb/access-reviews/preparing-and-completing-an-access-review/segregation-of-duties-in-uars/ab943445922a-a84855c7-648f-4a4a-b3b3-115b7fbfa78d2Fb9137606-f82f-41d0-a5e.webp" alt="step 4.webp" />
   </Frame>
3. Set a **Risk Level** (default is High). Risk levels are not currently used in reviews but may be supported in the future.

   <Frame>
     <img src="https://mintlify.s3.us-west-1.amazonaws.com/lumos-primary/images/kb/access-reviews/preparing-and-completing-an-access-review/segregation-of-duties-in-uars/d13e3cc1b29a-a84855c7-648f-4a4a-b3b3-115b7fbfa78d2F1743515755473-step5.webp" alt="step 5.webp" />
   </Frame>
4. Define a **Business Area** (e.g., Procure to Pay, Record to Reconcile, etc.) to organize rules.
5. Map out toxic role combinations by selecting:

   * Application A + Role/Permission A
   * Application B + Role/Permission B<img src="https://mintlify.s3.us-west-1.amazonaws.com/lumos-primary/images/kb/access-reviews/preparing-and-completing-an-access-review/segregation-of-duties-in-uars/ad75024f1404-a84855c7-648f-4a4a-b3b3-115b7fbfa78d2F1743515797029-step6.webp" alt="step 6.webp" />

These two combinations cannot coexist. Violations will be flagged during reviews.

***

## Reviewing SoD violations in Access Reviews

Once you've defined SoD rules in Lumos, you can detect and act on violations during user access reviews.

### Identifying violations

* Accounts with SoD violations will be tagged with a **"Violation"** category.
* A new column called **“SOD Rule(s) Violated”** displays the specific rule(s) triggered by the conflict.
* These violations are flagged even if the conflicting roles/permissions are across **different applications**.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/lumos-primary/images/kb/access-reviews/preparing-and-completing-an-access-review/segregation-of-duties-in-uars/166fce4f1cf8-a84855c7-648f-4a4a-b3b3-115b7fbfa78d2F1743516644190-scoping.webp" alt="scoping.webp" />
</Frame>

### Scoping Access Reviews to SoD rules

You can scope an access review to only include accounts that violate specific SoD rules, making it easier to focus on high-risk users.

To do so:

1. Go to **Review Settings** in your access review.
2. Scroll to the **Segregation of Duties Rules** filter.
3. Select the rule(s) you want to review.
4. Click **Apply**, then **Save Settings**.

Only accounts that violate the selected SoD rules will appear in the review.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/lumos-primary/images/kb/access-reviews/preparing-and-completing-an-access-review/segregation-of-duties-in-uars/56f50e257384-a84855c7-648f-4a4a-b3b3-115b7fbfa78d2F1743516657131-settings.webp" alt="settings.webp" />
</Frame>

***

## Ideal for

* Public companies and SOX-regulated organizations
* Teams managing access to sensitive systems like ERP, HRIS, CRM, and financial tools

***

## Known limitations

* Lumos does **not** currently provide out-of-the-box SoD rule templates or pre-mapped combinations of permissions.