Who accesses what, on what grounds, and since when?
Access governance with specialized AI agents: finds and treats segregation-of-duties conflicts over 100% of the data, optimizes roles through data mining and watches ITAC controls live.
NLC | SOD IntelligenceIllustration, fictitious data.
The access model rots in silence.
Granting is routine. Revoking almost never happens, and that's where risk piles up. None of these symptoms raises an alarm.
Privilege creep
Every internal move adds access. Nobody removes what's left.
Invisible conflict
Create + approve + pay in the same user, never mapped.
Untraced super-user
Unrestricted access to sensitive transactions, no approval or log.
Door that never closes
Leavers and expired contractors stay active.
Reviews that never happen
Managers bulk-approve without knowing what they approve.
Unwatched exceptions
No useful logs or alerts, abuse goes unnoticed for months.
Sources: ACFE, Report to the Nations 2024 · Brazilian Law 13,709/2018 (LGPD), Art. 52.
The problem isn't effort. It's scale.
- ✕Samples onlyThe conflict may be where nobody looked.
- ✕Depends on interpretationTwo analysts, two classifications.
- ✕Outdated the next dayThe snapshot only holds for that extract.
- ✕Doesn't scaleTens of thousands of combinations.
- ✓Processes 100% of the dataConflicts have nowhere to hide.
- ✓Deterministic and traceableEvery finding with source evidence.
- ✓Re-runnable any timeGovernance becomes a film, not a snapshot.
- ✓Scale by defaultBig data and specialized AI agents for the volume that breaks spreadsheets.
Business judgement, criticality, context, treatment decisions, stays human. AI agents remove the grunt work, not the accountability.
From raw data to a prioritized treatment plan.
Ingestion
Users, roles, permissions, transactions and logs.
Normalization
Cross-system standardization and identity reconciliation.
Enrichment
Job, department, cost center and HR status.
Detection
AI agents apply the SoD matrix per user.
Mining
Role mining reveals the minimal usage model.
Prioritization
Impact × likelihood and treatment sequence.
From conflict at the source to live monitoring.
SoD conflict discovery
Real user-level conflicts, single or cross-system.
Conflict treatment
Risk prioritization, compensating controls and remediation.
Role optimization
Data mining on actual usage designs the target role.
ITAC monitoring
In-application SoD controls, watched live.
Unapproved access
Out-of-process grants and pending certifications.
Orphan identities
Leavers with active access and contractors without a contract.
Graph engine
Users, roles, permissions and transactions as a graph: the conflict tables hide becomes visible.
AI copilot agent
Proprietary agents interpret findings, prioritize by risk and generate audit-ready evidence.
Full coverage
Analyzes 100% of the data, no sampling, and re-runs at any time.
Reducing the surface stops conflicts from coming back.
| Metric | Current model | Target model |
|---|---|---|
| Active roles | 217 | 94 |
| Overlapping roles | 68% | 0% |
| SoD conflicts | 199 | 11 |
| Permissions (index) | 100 | 48 |
| Access review | unworkable | routine |
Illustrative deliverable, a recurring order of magnitude observed by the team, not a specific client measurement.
ERP with many roles
SOX readiness
Post-merger / M&A
No governance yet
From assessment to live monitoring.
The three workstreams, SoD assessment, role optimization and IAM process review, in up to 6 weeks per system.
Assessment
IAM process, ITGC/ITAC and SoD matrix.
Remediation
Conflict treatment and role optimization.
Structuring
Role map and approved target roles.
Automation
Automatic provisioning within SoD rules.
Live monitoring
AI agents watching access in real time.
How many conflicts exist in your data right now?
If you don't know the number, you haven't found them. Step one is finding out, in your own data.