Audit Log Service  ·  View 37 of 40  ·  7 · Assurance

Roles and Separation of Duties

Eight roles against seven capabilities, where the blanks are the design.

Editable source SVG draw.io All views
Write a record Read records Export evidence Legal hold Retention policy Verify Operate Producer Own tenant only Investigator Scoped + justified Own result range Compliance Tenant-wide Budgeted, watermarked Propose only Any range Legal Hold Officer Place and lift Operator No record access Verifier Checkpoints only Retention Board Two approvals Break-glass PIM, time-boxed every action recorded Who May Do What — Blanks Are Denials, Not Omissions Two invariants shape the blanks. No role can both write a record and influence its retention or disposal; no role can both read records and administer the policy governing reading. The service's own operators appear here with a single capability and no read. v 1.0 · owner Data & AI Global Practice · date 2026-09

The two invariants

  • No role can both write a record and influence its retention or disposal.
  • No role can both read records and administer the policy that governs reading.
  • Together those two force the shape of the whole grid, and every blank cell is a denial that was chosen rather than a capability nobody got round to.

Notes on individual rows

  • The operator row has exactly one capability and it is not read. Running the service and reading its contents are different jobs held by different people.
  • Compliance may propose a legal hold but not place one; only the segregated legal role places and lifts, and that role cannot read the records it protects.
  • Break-glass exists, is time-boxed through PIM, requires a second approver, and every action taken under it is an audit event with the elevation reference attached.

Risks

  • Eight roles across 500 tenants is an access-review burden, and access reviews are where separation of duties usually decays. Quarterly recertification with automatic expiry is assumed and should be budgeted as an operating cost, not a project task.
◀  Identity and Credentials All views Key Custody  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 40 views · Microsoft Azure and open source37-roles-and-separation-of-duties