OneFinOps
Sign in Book a Demo

Controls before
money moves.

Identity, access, approvals, segregation of duties and audit evidence.

Book a Demo
Security and Controls

Why teams move to it.

Security and Controls governs who can do what.

Approvals
PR-2210 · $12,400 Blocked

Raised byA. Rao (you)

RulePreparer ≠ approver

Attempt14 Jul, 10:12

Routed to R. Menon
Control eventCE-11842

ActionApprove PR-2210

ResultBlocked at attempt

ConflictRequester = approver

Recorded14 Jul, 10:12:08

Nothing to find later

Preventive, not detective

A conflicting action is blocked when attempted, not found in a later review.

Segregation matrix
FinanceBuyingTreasury
AllowedReviewConflict
AR-0331 · A. Das

AP clerkGranted

Payment releaseBlocked

ConflictEnter + release

CheckedAt assignment

Blocked before it exists

Segregation checked at assignment

Role conflicts are detected as access is granted, so they never exist in production.

PR-2210 · $12,400.00 Path built from the authority matrix
  1. ARAnita RaoRequester12 Jul, 09:40
  2. RMRahul MenonCost centre 410 owner12 Jul, 11:02
  3. MIMaya IyerController · over $10kWaiting
  4. LPLeo ParkCFO · over $50kNot needed
Authority matrix

CC 410R. Menon

Over $10,000Controller

Over $50,000CFO

The path is the policy

Approvals that match the matrix

Authority limits are configuration, so the approval path is the policy itself.

Control evidenceFY26Year to date
48,212events
  • Approvals21,40044%
  • Segregation checks12,93027%
  • Period locks8,12017%
  • Access reviews5,76212%
QueryPeriodEventsExceptions
Approvals over limitQ2 20261,2040
Self-approval attemptsQ2 20261818 blocked
Posts in closed periodQ2 20263131 blocked

Evidence produced continuously

Control operation is recorded as it happens, so an audit is a query.

Inside Security and Controls.

Pick a capability to see what it does. Each one opens to a page of its own.

Single sign-on, provisioning and access that expires.

Explore Identity and Access
Sign-in · A. Rao Federated, provisioned, expiring
  1. 1Single sign-onIdentity provider · 09:00
  2. 2Multi-factorDevice key · 09:00
  3. 3Device trustManaged laptop
  4. 4Session policyOffice network · 8h
  5. 5Access expiryProject role · 31 Aug
Access grant AG-0331

RoleSite engineer

ScopeHarbour Tower

Granted1 Jul · S. Nair

Expires31 Aug · automatic

Leaves with the leaver

Break a control on purpose.

Bring your segregation matrix. We attempt a conflicting action and let it fail.

Book a Demo Back to the Platform