What does the privilege conflict checker produce?
Compare supplied identity-role assignments against your prohibited role pairs. Identify actual coassignments and retain incomplete or duplicate assignment rows for review.
The working area above runs the supported validator in the browser. It keeps the result inspectable and preserves every unresolved item for responsible review.
What do you need before you start?
- Define the authorized population, snapshot sources, system-qualified role IDs and exclusions.
- Obtain your prohibited role pairs and record the policy approval basis. No prohibited pair is inferred from a framework.
- Use UTF-8 CSV, rectangular text dataset JSON or one-sheet text-cell XLSX starting at A1. Each file supports 10 MB, 50 columns, 100000 cells, 10000 characters per cell and 5000000 parsed characters. Formulas, macros, numeric cells and additional worksheets are rejected.
What information do you enter?
Prepare only the bounded inputs listed below for this validator.
- Assignments source with Assignment reference, Identity and Role. Up to 5000 rows.
- Separate prohibited-pair policy with Rule reference, Role A, Role B and Basis. Up to 1000 rows. Each rule needs a unique reference and two distinct roles.
- Assignment population and snapshot basis, plus rule approval and review basis. Each supports 20000 characters.
| Field | What to enter | Fictional example |
|---|---|---|
| Assignment population and snapshot basisRequired | Name the systems, populations, snapshot versions and any exclusions. Use consistent identity IDs and system-qualified role IDs. | Fictional complete test population from Fictional Finance, snapshot 2026-10-06. This is not a live access collection. |
| Rule approval and review basisRequired | Identify your policy and reviewer. The tool does not invent prohibited roles or approve exceptions. | Fictional customer-approved role-pair policy, reviewed by a fictional control owner. Replace the policy and every identity. |
What you can download
Every result must identify its supplied facts, assumptions and unresolved items.
| Free result | Included downloads |
|---|---|
Enter your information, inspect the on-screen result and keep a browser backup. Editing and direct copies of your entered information stay free. |
These supported outputs are free. No checkout is required. |
Fictional privilege review (PDF). Editable review (DOCX). Complete fictional pack (ZIP). Fictional assignments (JSON). Fictional rules (JSON). Requires tailoring. Samples use the finalized renderer. Keep real source and result files private.
How does the privilege conflict checker work?
- 1Freeze the population and approved policy
Record systems, snapshot versions, identity conventions and policy approval. Prepare actual assignments and role-pair rules separately.
- 2Select two local sources
Inspect the policy preview or load the fictional example. Exact case, whitespace and Unicode remain significant. Both original files remain unchanged.
- 3Check actual coassignments
Identify identities holding both roles in each prohibited pair. Review missing fields and all duplicate assignment occurrences. Invalid policies stop the whole comparison.
- 4Keep complete results
Download complete JSON and assignment CSV free. Original downloads preserve exact file bytes. Review one finalized seven-file pack and its price before payment.
Method and sources
Apply the steps above to the supported inputs. Use the listed source sections to review the rule basis, assumptions and limits.
- Security and Privacy Controls for Information Systems and OrganizationsOrganization-defined duties and supporting access authorizations. This reference does not define the customer prohibited-role matrix. AC-5. Separation of Duties.National Institute of Standards and Technology. Reviewed 2026-10-06.
- Assessing Security and Privacy Controls in Information Systems and OrganizationsContext for reviewing organization-defined controls and assessment evidence. Tailored assessment procedures and AC-5 assessment.National Institute of Standards and Technology. Reviewed 2026-10-06.
Common questions
What information does the privilege conflict checker need?
Enter assignments source with Assignment reference, Identity and Role. Up to 5000 rows; separate prohibited-pair policy with Rule reference, Role A, Role B and Basis. Up to 1000 rows. Each rule needs a unique reference and two distinct roles; assignment population and snapshot basis, plus rule approval and review basis. Each supports 20000 characters. Define the authorized population, snapshot sources, system-qualified role IDs and exclusions.
What does the privilege conflict checker produce?
Formal PDF and editable DOCX review Complete assignment, conflict, rule-coverage and source Excel sheets Assignment findings CSV Complete private parsed-source and result JSON Delivered-file hashes and instructions Unchanged original assignments and rules downloads Review unresolved findings and limitations before use.
Who makes the final decision?
A responsible person reviews the result. This comparison uses the supplied population and explicit role-pair rules. It does not collect live access, expand inherited roles, resolve identity aliases, evaluate exemptions or change permissions. A result without a detected pair does not establish appropriate access or compliance.
Is this tool free?
Yes. The on-screen result and listed downloads are free. No checkout is required. Keep local backups and review the stated method and limits.
Can I use the privilege conflict checker for this task?
Find supplied identity-role assignments that match your approved prohibited role pairs. This comparison uses the supplied population and explicit role-pair rules. It does not collect live access, expand inherited roles, resolve identity aliases, evaluate exemptions or change permissions. A result without a detected pair does not establish appropriate access or compliance.
What still needs review?
This comparison uses the supplied population and explicit role-pair rules. It does not collect live access, expand inherited roles, resolve identity aliases, evaluate exemptions or change permissions. A result without a detected pair does not establish appropriate access or compliance.
Missing or duplicate assignment references do not hide known identity-role conflicts. All such rows remain unresolved. Every rule remains visible, including rules with no match.
PDF and DOCX summarize the first 100 assignments and 100 conflicts. Interface tables show the first 200 rows. Text previews are abridged after 400 characters. Excel and JSON preserve complete parsed sources and results. Results exceeding 25000 conflicts or 5000000 characters are rejected without a partial result.
The first earlier original for each source is preserved on replacement. Clear removes current and earlier browser files. Account saving requires enabled private cloud controls, sign-in, consent and verified payment authorization.