Toxic Access Combination Detector

Toxic Combination Rules

Live Detection Engine

Toxic combinations

Accounts flagged

0 / 0

No accounts flagged.

Permission granted Permission not granted Toxic combination (row flagged)

How it works

Every account holds an explicit permission set. A toxic combination is a segregation-of-duties (SoD) violation: a predefined rule is itself a set of two or more permissions that are individually harmless but dangerous together (e.g. the power to create a vendor plus the power to approve payments to that vendor lets one person invent a fake vendor and pay themselves). The engine checks, for every account, whether its current permission set is a superset of any rule's full permission set — a real set-containment test, recomputed on every click.

toxic(u) ⇔ ∃ rule r : rule.perms ⊆ perms(u)
matched(u) = { r ∈ RULES | rule.perms ⊆ perms(u) }
flagged    = { u | matched(u) ≠ ∅ }

Click any cell in the matrix to grant or revoke that permission for that account — the whole engine re-evaluates instantly, no partial state.
A row goes red the instant its permission set contains a full rule set, and clears the instant an edit removes even one permission from every rule it matched.
Randomize assignments simulates ad-hoc access requests being granted without SoD review — the most common real-world cause of new toxic combinations.
Rules can overlap: an account can trip more than one rule at once (e.g. holding read + export + delete on sensitive data trips both the "Data Exfiltration" and "Sensitive Data Destruction" rules).

Click a cell to grant/revoke a permission