"Vendor maintenance in Workday" plus "payment approval in SAP" should never meet in one person. Declare it once — the evaluator flags every identity holding both sides, across systems, however they got there.
Cross-system by design
SoD rules are condition pairs over your entitlement estate — cross-system, continuously evaluated. A dry-run previews violations before a rule goes live, and severity drives both the inbox and the risk score.
A business decision, kept human
Auto-revoking one side of a toxic combination would break legitimate work. Violations route to the advisor inbox and weigh into the holder's risk score; the resolution is a considered decision, with the evidence attached.
Governed vocabulary, seeded per framework
SoD rules cite a managed vocabulary — categories, framework references and compensating controls — seeded from activatable packs for SOX, GDPR, ISO/IEC 27001 and HIPAA. An overrule is time-boxed by a tenant-wide cap and carries its compensating control, so an exception is a documented decision instead of a shrug.
A 30-minute kickoff connects your HR feed and one system — working POC the same day.