Predictika · SOX segregation of duties

An AI agent's access request, checked for conflicting duties before it is granted

An AI access-request agent prepares a request to give an employee one more duty in a finance process: the duties the employee already holds, the duty requested, and any compensating control and how often it runs. Before the access is granted, the agent sends the request to Predictika, which checks it against a declarative model of segregation-of-duties rules and returns a verdict, every reason and the figures it computed.

Scope: SOX / COSO segregation of duties for finance access requests: conflicting duty pairs, compensating controls and control frequency against risk. See everything this validator covers

This validator checks a proposed duty grant against the duties an employee already holds — not just the scenarios shown below.

  • Duties — create vendor, approve vendor, create purchase order, approve purchase order, approve invoice, process payment, reconcile bank, post journal entry, approve journal entry, initiate wire and approve wire, for up to two existing duties and one requested duty.
  • Conflict pairs — create and approve vendor; create and approve purchase order; approve invoice and process payment; process payment and reconcile bank; post and approve journal entry; initiate and approve wire. A conflict is checked among the two existing duties and between each existing duty and the requested one.
  • Compensating controls — a conflict is acceptable only with a documented control that is independent of the employee; no control, or a control that is not independent, is a block.
  • Frequency against risk — High risk needs a continuous, daily or weekly control; moderate risk also accepts monthly; low risk also accepts quarterly. An independent control that runs too rarely is a block.
  • Sign-off — an adequately mitigated conflict is not a block, but it needs control-owner sign-off before access is granted.

Any duty request among the listed duties is in scope, not only the scenarios pictured here. Not covered: duties outside the list, more than two existing duties, role and entitlement mapping in a specific ERP or identity system, the design or testing of the controls themselves, and the audit conclusion. The conflict pairs and frequency rules are a simplified illustration of public SOX and COSO guidance, not any company's control matrix, and are not audit advice.

The AI access-request agentPrepares the access request from the employee's record and the control register and says it is ready to grant.
Predictika validatorChecks every rule at once and returns the verdict, each finding and the computed figures.

7 scenarios in 3 groups · each group runs from the agent’s first attempt to the outcome · click one to switch

What the agent proposes

The AI access-request agent says

Illustrative agent statement. The validator receives the structured request below.

Proposing agent: AI access-request agent (scripted)

Before granting, the agent must call Recorded run

Predictika validator


      

        
        
        
      

      
Waiting for the call.

      
    

  

  
  

    
Where typical rules-based tools get it wrong
Click to expand
    
Our assessment of what a typical rules-based tool (role conflict matrices, access-request workflows and approval routing configured in an identity or ERP governance system) does with the same cases. It is our assessment, a judgment about effort and reliability, not a claim that nothing can be built.

    
What the validator caughtTypical rules-based toolPredictika
A conflict between a duty held and a duty requestedOnly if someone is vigilant
A matrix of conflicting pairs works for two duties, but it has to be checked in both directions and across every duty the employee holds.		Every held duty is checked against the requested duty and against each other on the same call.
A control that must be independent and frequent enough for the risk levelOnly with workarounds
Independence, frequency and risk level sit in different places and the allowed frequency depends on the risk, so it is a cross-field rule that is hard to keep in step.		Control, frequency and risk level are checked together; a control that runs too rarely is blocked, not just flagged.
A mitigated conflict that needs sign-off but is not a blockOnly if someone is vigilant
Approval routing is usually set up apart from the conflict check, so a mitigated conflict can be routed as a plain approval or blocked outright.		The verdict separates block, needs approval and allow, with the reason for each.
Every problem returned in one answerOnly with workarounds
Checks tend to fire one at a time as the request moves through steps, so a requester fixes one problem and meets the next.		All findings come back together, whatever order the choices arrived in.

  

  

    
What this validator catches
Click to expand
    
Every rule is checked on every call, in any order the choices arrive; one problem never hides another. Blocking findings stop the request; approval findings need a person to sign off; everything else is computed.

    
1An employee may not hold two duties that conflict (create and approve vendor, create and approve purchase order, approve invoice and process payment, process payment and reconcile bank, post and approve journal entry, initiate and approve wire).
2A requested duty may not conflict with either of the duties the employee already holds.
3A conflict with no documented compensating control is blocked.
4A conflict whose documented control is not independent of the employee is blocked.
5A conflict with an independent control that runs too rarely for the risk level is blocked (high risk: continuous, daily or weekly; moderate: also monthly; low: also quarterly).
6A conflict with an independent control that is frequent enough for the risk level needs control-owner sign-off.
7Holding the same duty twice, or requesting no duty, is not a conflict.

  

  

    
Scenarios and results
Click to expand
    
The recorded result of the validator for each scenario on this page: the request the AI agent sent, the verdict, and every finding, in the order they appear above.

    
1. Purchase order duties: Create and approve purchase orders with a control that runs too rarely

    
The agent's request. Please grant the Approve purchase order duty to Marcus Ellery (E-1187) in Procure to pay.

    
Verdict: Blocked.

    
    
      
  • Control runs too rarely for the risk level. Approve purchase order conflicts with Create purchase order, which Marcus Ellery already holds. The independent control runs quarterly, which is not frequent enough for Moderate risk.
    • 
    

    
2. Purchase order duties: The agent resubmits after fixing the errors

    
The agent's request. Please grant the Approve purchase order duty to Marcus Ellery (E-1187) in Procure to pay.

    
Verdict: Needs approval.

    
    
      
  • Mitigated conflict needs control-owner sign-off. Approve purchase order conflicts with Create purchase order, but an independent monthly control is documented and is frequent enough for Moderate risk; the control owner must sign off.
    • 
      
  • Access summary. A segregation-of-duties conflict exists among the duties held and requested.
    • 
    

    
3. Purchase order duties: The agent resubmits after fixing the errors

    
The agent's request. Please grant the Approve invoice duty to Marcus Ellery (E-1187) in Procure to pay.

    
Verdict: Allowed.

    
    
      
  • Access summary. A segregation-of-duties conflict does not exist among the duties held and requested.
    • 
    

    
4. Vendor master duties: Create vendor and approve vendor for one employee, no control

    
The agent's request. Please grant the Approve vendor duty to Priya Raman (E-1041) in Procure to pay.

    
Verdict: Blocked.

    
    
      
  • Duty conflict with no valid control. Approve vendor conflicts with Create vendor, which Priya Raman already holds. No compensating control is documented.
    • 
    

    
5. Vendor master duties: The agent resubmits after fixing the errors

    
The agent's request. Please grant the Approve vendor duty to Priya Raman (E-1041) in Procure to pay.

    
Verdict: Needs approval.

    
    
      
  • Mitigated conflict needs control-owner sign-off. Approve vendor conflicts with Create vendor, but an independent daily control is documented and is frequent enough for High risk; the control owner must sign off.
    • 
      
  • Access summary. A segregation-of-duties conflict exists among the duties held and requested.
    • 
    

    
6. Vendor master duties: The agent resubmits after fixing the errors

    
The agent's request. Please grant the Create purchase order duty to Priya Raman (E-1041) in Procure to pay.

    
Verdict: Allowed.

    
    
      
  • Access summary. A segregation-of-duties conflict does not exist among the duties held and requested.
    • 
    

    
7. Wire transfer duties: Journal entry access for an employee who already holds both wire duties

    
The agent's request. Please grant the Post journal entry duty to Dana Whitcomb (E-1203) in Treasury.

    
Verdict: Blocked.

    
    
      
  • Duty conflict with no valid control. Dana Whitcomb already holds Initiate wire and Approve wire, which conflict. No compensating control is documented.
    • 
    

  

  

    
Narration transcript
Click to expand
    
The text of the narrated walkthrough, step by step.

    
    
      
  1. Welcome to a demo of Predictika's Validator. An AI access-request agent prepares a request to give an employee one more duty in a finance process: the duties the employee already holds, the duty requested, any compensating control and how often it runs. Before the access is granted, the agent sends the request to Predictika, which checks it against a declarative model of segregation-of-duties rules and returns a verdict, every reason and the figures it computed.
    2. 
      
  2. I will start with the first request by the agent.
    3. 
      
  3. The agent says. Please grant the Approve purchase order duty to Marcus Ellery (E-1187) in Procure to pay.
    4. 
      
  4. Before it goes out, the agent calls the validator.
    5. 
      
  5. Blocked, with one finding, all in one answer. Approve purchase order conflicts with create purchase order, which Marcus Ellery already holds. The independent control runs quarterly, which is not frequent enough for Moderate risk.
    6. 
      
  6. The validator returned one blocking finding in one answer. A check that reads one field at a time would pass most of this; it shows only when the choices in the access grant are checked against each other.
    7. 
      
  7. What this shows: for a control that must be independent and frequent enough for the risk level, a rules-based tool can do this only with workarounds.
    8. 
      
  8. Now the agent resubmits.
    9. 
      
  9. The corrected request. It changes the control frequency to monthly.
    10. 
      
  10. It calls the validator again.
    11. 
      
  11. Not blocked, but held for a person.
    12. 
      
  12. The one blocking finding is cleared; one approval remains for a person: mitigated conflict needs control-owner sign-off.
    13. 
      
  13. The agent resubmits once more.
    14. 
      
  14. The revised request. It changes the requested duty to approve invoice.
    15. 
      
  15. It calls the validator once more.
    16. 
      
  16. This time the validator clears it.
    17. 
      
  17. The earlier finding is cleared.
    18. 
      
  18. One problem caught in one call, fixed in two passes, and a clean access grant. That is the value of Predictika's validator: catching mistakes before the access is granted.
    19.