<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: detecting-identity-governance-violations
description: >-
  Detect violations of identity governance policies including separation of
  duties conflicts, excessive privileges, orphaned accounts, access policy
  drift, and non-compliant role assignments across identity systems.
domain: cybersecurity
subdomain: identity-security
tags:
  - identity-governance
  - sod-violations
  - access-reviews
  - policy-compliance
  - iga
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
  - T1078
  - T1098
  - T1136
  - T1069
  - T1087
---

# Detecting Identity Governance Violations

## Overview

Identity governance violations represent security risks that accumulate over
time through policy drift, role creep, and inadequate access reviews. Detection
requires continuous monitoring of role assignments, group memberships, privilege
levels, and separation of duties constraints against defined policies.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Python 3.10+ | Agent tooling |
| SIEM access | Log correlation |
| IdP API access | Identity provider queries |
| `pip install msal` | Microsoft auth library |
| `pip install okta` | Okta SDK |

## Key Concepts

### Governance Violation Categories

| Violation | Description | Risk |
|---|---|---|
| SoD Conflict | User holds conflicting roles | Fraud, compliance |
| Excessive Privilege | More access than role requires | Blast radius |
| Orphaned Account | No owner or inactive owner | Unauthorized access |
| Stale Access | Access no longer needed | Lateral movement |
| Policy Drift | Config diverges from baseline | Control bypass |
| Missing Reviews | Access not certified on schedule | Compliance |

### Separation of Duties Matrix

```python
SOD_CONFLICTS = {
    ("accounts_payable", "accounts_receivable"): "financial_fraud",
    ("developer", "production_admin"): "deployment_integrity",
    ("security_admin", "audit_admin"): "audit_independence",
    ("user_admin", "global_admin"): "privilege_separation",
    ("hr_admin", "payroll_admin"): "payroll_fraud",
}
```

## Workflow

```
1. DEFINE     — Document governance policies, SoD matrix, and thresholds
2. INVENTORY  — Enumerate all identities, roles, and entitlements
3. SCAN       — Run violation detection against policy rules
4. CLASSIFY   — Categorize violations by type, severity, and scope
5. REMEDIATE  — Revoke excess, resolve SoD, remove orphans
6. CERTIFY    — Run access reviews for remaining exceptions
7. AUTOMATE   — Deploy continuous governance monitoring
```

## Verification

```bash
# Validate agent script
python3 -m py_compile scripts/agent.js && echo "OK" || echo "FAIL"
ruff check scripts/agent.js

# Run agent help
node scripts/agent.js --help
```

## References

- [MITRE ATT&CK — Identity Techniques](https://attack.mitre.org/tactics/TA0006/)
- [NIST SP 800-63 Digital Identity Guidelines](https://pages.nist.gov/800-63-3/)
- [NIST SP 800-207 Zero Trust Architecture](https://csrc.nist.gov/publications/detail/sp/800-207/final)
- [CIS Controls v8](https://www.cisecurity.org/controls/v8)
