Governance

Separation of Duties

Separation of Duties (SoD) ensures that no single person can carry out a sensitive action from start to finish alone — a cornerstone of fraud prevention.

The idea in one sentence

The person who requests something shouldn't also be the one who approves it. Splitting these responsibilities means a mistake or bad actor can't push a harmful action through unchecked.

Everyday examples

The employee who creates a payment can't approve it.
The person who submits an expense can't sign off on their own claim.
Whoever raises a purchase order can't be the sole approver for the vendor.

Enforced automatically

You don't have to police this manually. When SoD rules apply, BOS blocks the conflicting action and routes it to someone else for approval.

How it works in BOS

SoD rules are checked by the workflow engine alongside roles and attributes. When a rule would be violated, the action is stopped and an approval is routed to an eligible, different person.

It applies to the AI too

The Orin assistant is bound by the same SoD rules. Even at the highest autonomy level, Orin can't both create and approve a separated action.

Configuring SoD

Administrators define SoD rules in Settings, choosing which action pairs must be performed by different people. Changes are recorded in the audit trail.

Plan for enough approvers

Because SoD requires a second person, make sure each sensitive process has at least two eligible people — otherwise actions can stall waiting for an approver.