Clear Skye Separation of Duties (SoD) helps organizations proactively manage risk by preventing and detecting inappropriate access combinations. The solution provides a reusable framework for defining and enforcing SoD policies, including toxic combinations, toxic access, and required access patterns—all supported by a flexible policy lifecycle and actionable visibility.
Designed with compliance teams in mind, Clear Skye SoD simplifies oversight by offering version-controlled policy management, approval workflows, and real-time metrics. These capabilities make it easier to identify violations, enforce preventative controls, and maintain audit-ready records. As a result, compliance teams can respond faster, reduce manual effort, and ensure ongoing alignment with regulatory and internal standards.
Enforces Segregation of Duties to Prevent Fraud and Unauthorized Access
Simplifies Segregation-of-Duties Policy Creation with Business-Friendly Capabilities
Deploys Preventative and Detective Controls for Risk Management
Continuously Monitors Access to Detect Compliance Issues
Automates Customized Compliance Responses via ServiceNow Workflows
Enhances Operational Efficiency with Streamlined Policy Management
Supports Must-Have Permission Pairings for Comprehensive Risk Control
Integrates Seamlessly with Clear Skye IGA
Clear Skye SoD 1.2 is an enhanced release of a native ServiceNow separation-of-duties application which integrates with Clear Skye IGA. Version 1.2 provides stability, efficiency, and user experience updates.
Features in this initial release include:
Delta Scanning
- Detective scans can now run incrementally, evaluating only the identities that have changed since your last successful scan instead of re-processing the entire population. Each scan automatically resumes from where the previous one finished, significantly reducing scan time and system load, especially for large user populations. Delta scans work alongside periodic full scans, which continue to provide complete reconciliation and catch any drift outside the change stream.
Concurrent Scanning
- Multiple detective scans can now run at the same time, with available scan capacity managed automatically across your instance's processing nodes. Each scan is assigned to a node with free capacity and runs there, so work is balanced across nodes rather than concentrated on one. When capacity is fully in use, additional scans are no longer dropped. They are safely queued and start on their own, on the next available node, as soon as capacity frees up. This ensures every requested scan runs to completion without manual retries.
Preventative Enforcement Across In-Flight Requests
- SoD policy enforcement now evaluates access that has been requested but not yet granted. Toxic combinations and required access violations are identified while a request is still in progress, not just after access is provisioned. This closes the gap where two separately approved requests could combine into a conflict, giving approvers and reviewers visibility into the risk before any access is assigned.
Clear Skye SoD is a native ServiceNow application with no external system requirements.
Clear Skye IGA 5.4 or later is a required prerequisite for Clear Skye SoD.
Other Requirements:N/A