{"id":"sec-fin-duties-conflict-review","audience":"finance","category":"security","track":"security","technique":"constraints","title":"Spot segregation of duties conflicts in finance access","free":false,"task":"For the quarterly access review, find users whose roles break your segregation of duties rule: nobody may both create or edit vendors AND approve payments. List only the conflicting users, numbered, as 'user - conflicting roles - suggested fix (remove one role)'. Plain text, under 70 words.","materialLabel":"Role export and role definitions (attached to your prompt automatically)","material":"Role definitions (finance system):\n- VEND_MAINT: create and edit vendors, including bank details\n- AP_ENTRY: enter invoices\n- PAY_APPROVE: approve payments\n- GL_VIEW: read-only general ledger\n- RPT_VIEW: read-only reports\n\nUser role export (Nov 6, 2026):\nm.reyes   | AP_ENTRY, VEND_MAINT, GL_VIEW\nj.chen    | VEND_MAINT, PAY_APPROVE\ns.patel   | PAY_APPROVE, GL_VIEW, RPT_VIEW\nt.nakamura| AP_ENTRY, PAY_APPROVE\nl.ogun    | VEND_MAINT, PAY_APPROVE, RPT_VIEW\na.berg    | RPT_VIEW, GL_VIEW\n\nNotes:\n- t.nakamura entering invoices and approving payments is allowed by our current rule; Audit may tighten that next year.\n- j.chen is the AP manager and says he \"needs everything for month-end\".\n- l.ogun moved from AP to Treasury in September.","rules":[{"type":"numberedItems","count":2},{"type":"plainText"},{"type":"maxWords","max":70}],"mistakes":[{"title":"Using a stricter rule","why":"The AI applies textbook segregation of duties and flags t.nakamura too.","fix":"Say: \"Only the rule: vendor create/edit AND payment approval.\"","checks":["r1"]},{"title":"Accepting the manager's reason","why":"The AI suggests an exception for j.chen because he's the AP manager.","fix":"Add: \"No exceptions for seniority. Suggest removing one role.\"","checks":["r2"]},{"title":"Listing every user","why":"The AI reviews all 6 users.","fix":"Ask: \"List only conflicting users.\"","checks":["r0","numberedItems"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 70 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 50 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the review record they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"States the exact rule","patterns":["vend_maint","pay_approve","vendor","approve payments"]},{"label":"Lists only conflicts","patterns":["only (the )?(conflict|users)","conflicting"]},{"label":"Asks for a fix","patterns":["fix","remove (one )?role","suggest"]},{"label":"Sets a word limit","patterns":["\\d+\\s*words","word (limit|count)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"Segregation of duties depends on your exact rule. Give the AI the one combination that's banned, and ask only for users who have it.","rubricLabels":["Lists exactly j.chen and l.ogun, each with VEND_MAINT and PAY_APPROVE as the conflicting roles","Does not list t.nakamura (AP_ENTRY plus PAY_APPROVE is allowed by the current rule), m.reyes, s.patel or a.berg","Each line suggests removing one of the two roles, and j.chen's line does not keep both roles because of his 'needs everything' comment"]}