Toxic Combination
A pair of permissions that is acceptable individually and dangerous together, which is what a segregation-of-duties model exists to identify.
Segregation of duties is usually described as splitting a process so no single person controls it end to end. Operationally, it reduces to enumerating the combinations that must not co-occur.
The classic pairs: create a supplier and approve a payment; write code and deploy it to production unreviewed; grant privileged access and use it; modify a transaction and alter the audit log that records the modification.
Each half is a legitimate permission held by someone. The risk is only in the conjunction, which is why role-by-role review does not find it — an access review that examines each role in isolation will approve both, and the combination is invisible unless something is looking for it specifically.
Detection therefore has to be a rule evaluated across a person's effective permissions, including those inherited through group membership, role nesting and temporary elevations. That last one is where most real violations occur: the combination does not exist in standing access and does exist for the hour during which someone holds an emergency elevation.
Where an organisation is genuinely too small to segregate, the accepted answer is a compensating detective control — independent review of the combined activity — which must be documented as a deliberate acceptance rather than left as a silent gap.