No single agent, and no single orchestrator, should hold both halves of an incompatible pair: initiating and approving, recording and reconciling, creating a supplier and paying one. Map every capability to a duty, check conflicts within each agent and across agents that share an identity or coordinator, and put a named person at every conflict point.
What is the process, and who owns it?
Separation of duties means one party cannot both commit and conceal an error or a fraud. The principle, explained in what is segregation of duties?, was written for people, but separation of duties still applies when the worker is software. An agent that can raise a payment and mark it reconciled has the same conflict as a clerk who can.
Agents add two new ways to break separation. One agent coordinating two others can steer both sides of a conflict. And agents that share an identity, credentials or memory are, for control purposes, one party. The head of internal control or the financial controller owns the rules; the process owner applies them to each agent.
What are the steps, and who acts at each one?
- Person, head of internal control: lists incompatible duties for each process, usually by updating the existing matrix used for staff.
- Agent, depth 1: maps capabilities to duties. From each agent's capability list, it tags every capability with the duty it performs, such as "initiate payment" or "post journal".
- Agent, depth 1: finds conflicts. It checks each agent for incompatible pairs, then checks groups of agents that share an identity, credentials, memory or an orchestrator, treating each group as one party.
- Person, process owner: resolves each conflict by removing a capability, moving it to a different agent with a separate identity, or placing a held step so a person decides at the conflict point.
- Person, identity team: enforces the split through separate identities and entitlements, so an agent cannot reach the other half even if its brief is wrong.
- Agent, depth 1: is tested. Each agent and each orchestrator attempts both halves of every pair in a test environment.
- Person, head of internal control: signs the matrix for agents, alongside the staff matrix.
- Person, process owner: reviews conflicts at every access review and whenever a capability is added.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Incompatible duties | Nothing | none | Defining the pairs |
| Map capabilities | Tags each capability with its duty | 1 | Checking the tags |
| Find conflicts | Checks agents and agent groups | 1 | Nothing |
| Resolve | Nothing | none | Choosing how to split |
| Enforce | Nothing | none | Granting separate entitlements |
| Test | Attempts both halves in test | 1 | Reviewing results |
| Sign | Nothing | none | Approving the matrix |
| Review | Nothing | none | Re-checking after changes |
What evidence does each step leave?
- Incompatible duties: the matrix, versioned; the separation of duties matrix for AI agents shows the columns.
- Map capabilities: a table of capability, agent and duty.
- Find conflicts: a conflict report listing each pair and the agent or group holding it.
- Resolve: the decision and reason for each conflict.
- Enforce: entitlement exports per identity showing no identity holds both halves.
- Test: refused verdicts for each attempted conflicting action.
- Sign: the signed matrix.
- Review: a dated review record per agent.
Which controls make it hold?
Separate identities. Two agents on one identity are one agent to every system they touch. Keep each identity distinct.
Separate credentials. If agents can read each other's keys, they can act as each other. Credentials should never reach the agent at all; see how do you keep credentials and keys away from an AI agent?
Orchestrators cannot span a conflict. An orchestrating agent at depth 5 may coordinate work, but it must not coordinate both an initiating agent and an approving agent for the same transaction. Place a person between them.
No shared memory across a conflict. If agent A's notes are readable and writable by agent B, a manipulated note can pass a decision across the line.
A person at the conflict point. Where a process must flow from one duty to the other, the hand-over goes through a named person's approval.
What should you measure?
Count conflicts found per review, conflicts open past their due date, refusals of conflicting actions in production, and agents whose duties were not mapped. Every refusal in production should be explained, because it means an agent attempted something on the far side of a line.
Where does it usually go wrong?
Only individual agents are checked. Each agent looks clean, but together, under one orchestrator, they cover both halves.
The staff matrix is ignored. Agents get their own rules that do not match the firm's existing ones, and auditors find two inconsistent standards.
Agents are missing from the inventory. Conflicts cannot be checked for agents nobody knows about. Separation starts with knowing what exists, as how do you keep an inventory of AI agents? explains.
An agent becomes the reviewer. A second agent "approves" the first agent's work and both are counted as separate. A check by an agent can help, but approval at a conflict point belongs to a person.
Where Pryme fits
In Pryme, each agent's role scope sets which capabilities it holds, and every action meets the minimum chain of five bounds, so an agent outside its scope is refused and the refusal is filed. Orchestrators are a separate depth and do not inherit the capabilities of the agents they coordinate. More in agent governance is a bound, not a model.
Questions people ask
Can one agent prepare and another agent approve?
The second agent can check and flag, which is useful. The approval at a conflict point should be made by a named person, because an agent cannot carry the accountability that separation is designed to create.
Do people and agents share the same matrix?
They should. Add agents as rows alongside roles. That makes it visible when a person and an agent together hold both halves of a pair, for example a person who can change an agent's brief and also approve its output.
What about small teams without enough people to separate duties?
Use compensating controls: holds with a second reviewer from another team, after-the-fact review of a sample, and alerts on the riskiest pairs. Do not solve a staff shortage by giving one agent both duties.