Separation of Duty

Prevent a single subject from holding two conflicting roles. The same person cannot both submit and approve the same request.

Creating a constraint

cURL

curl -X POST https://api.wardenauthz.com/v1/scope/workspace-eng/sod-constraint \
  -H "x-api-key: YOUR_MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "expense-submit-approve",
    "roleIds": ["expense-submitter", "expense-approver"],
    "description": "Cannot both submit and approve expenses"
  }'

After creating this constraint, any attempt to assign both roles to the same subject returns a conflict error.

Edge cases

• Removing a constraint does not retroactively affect existing assignments. Only future assignments are blocked.
• SoD is evaluated at assignment time, not access check time. The check runs when you create or update an access policy.