{"id":"acct-segregation-of-duties-conflict-table","audience":"accounting","category":"finance-work","track":"finance","technique":"constraints","level":"advanced","title":"Screen user permissions against three conflict rules","free":false,"task":"You're helping the controller screen system access for conflicts. Write a prompt for a markdown table with columns User, Conflict and Rule, one row per user in the listed order. Conflict is exactly Yes or No and Rule names the rule number that applies (or a dash). Conflict rules: R1 = create vendor and approve payment; R2 = post journal entry and approve journal entry; R3 = approve payment and reconcile bank. Only these rules count. After the table add \"For controller:\" with one sentence saying the Yes rows are flags for review, not findings about anyone. Under 130 words.","materialLabel":"Source material (attached to your prompt automatically)","material":"SYSTEM ACCESS REVIEW - Finance team, Nov 2026\n\nUser | Permissions\nAna | Create vendor; Approve payment\nBen | Post journal entry; Approve journal entry\nCho | Create vendor; Enter invoices\nDev | Approve payment; Reconcile bank\nEli | Post journal entry; Reconcile bank\n\nControls in place (as reported by the controller): the CFO reviews every payment Ana approves over $5,000. Ben's journal entries are also reviewed monthly by the controller.\n\nBackground: the team is small (five people) and access was set up when the company had a different structure. The external auditors will ask about system access in the audit. The IT manager says Eli's combination \"looks risky\" and that Cho's permissions are \"a lot for one person\". The review is to identify conflicts against the written rules only, and it is not a performance review or an investigation. The controller will decide what changes are needed.","rules":[{"type":"maxWords","max":130}],"promptHints":[{"label":"Names the columns","patterns":["user","conflict","rule"]},{"label":"States the three rules","patterns":["r1","r2","r3","create vendor"]},{"label":"Limits to those rules","patterns":["only these rules","only the three"]},{"label":"Frames as flags","patterns":["flags","not findings"]},{"label":"Caps length","patterns":["\\d+\\s*words","under \\d+"]}],"mistakes":[{"title":"Flagging Eli and Cho","why":"The AI follows IT's opinion and marks Yes.","fix":"Say: \"Only the three rules count.\"","checks":["r0","r1"]},{"title":"Treating controls as clearing the conflict","why":"The AI marks Ana as No because the CFO reviews her payments.","fix":"Add: \"A conflict is Yes even if a review control exists.\"","checks":["r0"]},{"title":"Accusatory language","why":"The AI says Ana or Dev may be committing fraud.","fix":"Add: \"Flags for review, not findings about anyone.\"","checks":["r2"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting and runs past word limits.","fix":"Ask for fewer words than the real cap and keep each part short.","checks":["maxWords"]}],"hint":"Check each user against the written rules only. Don't let opinions or controls change a Yes.","rubricLabels":["The table has five rows in the listed order with Conflict values Yes, Yes, No, Yes, No for Ana, Ben, Cho, Dev and Eli","The Rule column shows R1 for Ana, R2 for Ben, a dash for Cho, R3 for Dev and a dash for Eli (Eli and Cho are not flagged even though IT thinks they look risky)","A line starting \"For controller:\" says the Yes rows are flags for review and not findings about anyone, and nothing implies wrongdoing"]}