All papers / No. 04 / AI Agent Governance
Segregation of duties (SoD) rests on a simple rule: no single subject should hold the mix of privileges that makes fraud, or a serious error, possible without collusion. Identity governance platforms enforce that rule as pairs of conflicting entitlements, checked when access is provisioned and again at certification. Every one of those checks assumes the subject is a person, and an autonomous AI agent breaks the assumption. The gap is precise. Conflict definitions cover standing grants, while the toxic combination in agent work emerges in the ordered sequence of tool calls inside a single task. Independence of maker and checker is assumed, while the operator who launches an agent often approves the agent's output as well. Evaluation runs identity by identity, while delegation splits a conflicting pair across an orchestrator and its sub-agents, so no single grant set shows the conflict. The paper answers the gap with SoDA, a conceptual policy model for agent tool access, built on a four-class conflict taxonomy covering capability-pair, sequence, delegation, and approval conflicts, and enforced at three points: provisioning-time prevention that reuses existing IGA SoD checks, runtime sequence enforcement at the tool gateway, and post-hoc trace review as the agent analog of certification. The contributions are (1) a gap analysis showing three specific breakdowns of classic SoD under agentic execution, (2) a four-class conflict taxonomy for agent capabilities, and (3) the SoDA policy model and three-point enforcement architecture, mapped onto controls and tooling that identity teams already run. The contribution is conceptual: a framework and a gap analysis, with no datasets, experiments, or measured results.
© 2026 Prabin Shrestha. Licensed under CC BY-ND 4.0: share unchanged with attribution; no derivatives.
Keep reading