# Separation of duty : forbidden association **URL:** \ **Category:** SHF Discussion and Questions\ **Tags:** separation-of-duties, sailpoint-identity-security\ **Created:** [November 13, 2024, 10:13am UTC](https://developer.sailpoint.com/discuss/t/separation-of-duty-forbidden-association/89360 "2024-11-13T10:13:43Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![llebrault](https://avatars.discourse-cdn.com/v4/letter/l/13edae/32.png) [@llebrault](https://developer.sailpoint.com/discuss/u/llebrault)\ **Post date:** [November 13, 2024, 10:13am UTC](https://developer.sailpoint.com/discuss/t/separation-of-duty-forbidden-association/89360/1 "2024-11-13T10:13:44Z")
Hi, I’m currently working on SoD and I have a question. I understood how to use it to get data and approvals of some items. But i’m left with one last case : What if, I want to achieve a complete forbidden association : Entitlement A and Entitlement B can never be granted to someone. How would I do it, using the best practices possible. Regards, Loïc. ---
**Author:** ![gourab](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/gourab/32/18650_2.png) [@gourab](https://developer.sailpoint.com/discuss/u/gourab)\ **Post date:** [November 13, 2024, 10:23am UTC](https://developer.sailpoint.com/discuss/t/separation-of-duty-forbidden-association/89360/2 "2024-11-13T10:23:17Z")
Hi @llebrault Please find here in detail regarding SoD policies: [Handling Policy Violations - SailPoint Identity Services](https://documentation.sailpoint.com/saas/help/sod/policy-violations.html) To answer your question, although it relates to SoD, since the use case is not to grant specific entitlements to anyone, I would suggest marking these entitlements as non-requestable. Additionally, avoid creating any access profiles or roles using these forbidden entitlements. Hope this helps! ---
**Author:** ![llebrault](https://avatars.discourse-cdn.com/v4/letter/l/13edae/32.png) [@llebrault](https://developer.sailpoint.com/discuss/u/llebrault)\ **Post date:** [November 13, 2024, 10:34am UTC](https://developer.sailpoint.com/discuss/t/separation-of-duty-forbidden-association/89360/3 "2024-11-13T10:34:57Z")
Thanks. In that case, entitlement should be requestables, but never together on a same identity. The association is forbidden. I’ve thought about using triggers and using Access Request Submitted trigger to deny the access request as soon as it triggers. I’m just wondering if there is a better way to do it. Regards, ---
**Author:** ![gourab](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/gourab/32/18650_2.png) [@gourab](https://developer.sailpoint.com/discuss/u/gourab)\ **Post date:** [November 13, 2024, 10:53am UTC](https://developer.sailpoint.com/discuss/t/separation-of-duty-forbidden-association/89360/4 "2024-11-13T10:53:09Z")
I don’t think blocking access requests is possible for SoD violations out of the box. ![image](https://global.discourse-cdn.com/sailpoint/original/2X/b/b413f24610c01c0f27f3fd8dacab30ecae1c2fdb.png) ---
**Author:** ![llebrault](https://avatars.discourse-cdn.com/v4/letter/l/13edae/32.png) [@llebrault](https://developer.sailpoint.com/discuss/u/llebrault)\ **Post date:** [November 13, 2024, 11:45am UTC](https://developer.sailpoint.com/discuss/t/separation-of-duty-forbidden-association/89360/5 "2024-11-13T11:45:58Z")
Yes that is what I indeed understand. So my question would be how to achieve, best practice as possible, a true preventative SoD, to deny B to be given when A is also given or already possessed. Regards, ---
**Author:** ![mcheek](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/mcheek/32/23705_2.png) [@mcheek](https://developer.sailpoint.com/discuss/u/mcheek)\ **Post date:** [November 13, 2024, 1:59pm UTC](https://developer.sailpoint.com/discuss/t/separation-of-duty-forbidden-association/89360/6 "2024-11-13T13:59:56Z")
Where are your access requests coming from? If they’re originating from an external system like ServiceNow, you can run the [start-predict-sod-violations](https://developer.sailpoint.com/docs/api/v3/start-predict-sod-violations) API endpoint to see if there would be any violations and cancel the request if there are. Sounds like if request center is used, that’s not possible ---
**Author:** ![llebrault](https://avatars.discourse-cdn.com/v4/letter/l/13edae/32.png) [@llebrault](https://developer.sailpoint.com/discuss/u/llebrault)\ **Post date:** [November 13, 2024, 2:14pm UTC](https://developer.sailpoint.com/discuss/t/separation-of-duty-forbidden-association/89360/7 "2024-11-13T14:14:24Z")
Interesting. They’d come from both alas. would trigger into webhook into deny access be a viable solution ? ---
**Author:** ![jsosa](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jsosa/32/31578_2.png) [@jsosa](https://developer.sailpoint.com/discuss/u/jsosa)\ **Post date:** [November 13, 2024, 3:36pm UTC](https://developer.sailpoint.com/discuss/t/separation-of-duty-forbidden-association/89360/8 "2024-11-13T15:36:43Z")
Hi @llebrault As you have to left both entitlements requestable, and enforce users to not have both at same time, what I can recommend is to create a workflow to remove entitlements where both are being provisioned. Provisioning Completed trigger input has the attributeRequests array, which you should inspect with JSONPath or comparator operators, to question if both entitlements are present: ![image](https://global.discourse-cdn.com/sailpoint/original/3X/d/7/d7011a8c879556bbd5a1a6a81c9f1093efff73e0.png) So, if both entitlements are present, you can raise an HTTP Request action to send a REVOKE\_ACCESS request submit for them, followed perhaps by a notification. I do not know your business model there, but I think that if Identity has some atrtibute that can let you deduct what of the two entitlements should not have, you can raise an HTTP Request to revoke only the incorrect entitlement. ---
**Author:** ![llebrault](https://avatars.discourse-cdn.com/v4/letter/l/13edae/32.png) [@llebrault](https://developer.sailpoint.com/discuss/u/llebrault)\ **Post date:** [November 14, 2024, 12:26pm UTC](https://developer.sailpoint.com/discuss/t/separation-of-duty-forbidden-association/89360/9 "2024-11-14T12:26:49Z")
I see, that is similar to what I had in mind but using solely wf. I’ll think about it. Thank you! ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [January 13, 2025, 12:27pm UTC](https://developer.sailpoint.com/discuss/t/separation-of-duty-forbidden-association/89360/10 "2025-01-13T12:27:33Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.