Oracle ERP Testing Tool > Test Library > Security

Syntra Standard Oracle Test Library

Oracle Fusion Segregation of Duties Test Cases

Validate that potential conflicting-duty combinations in Oracle Fusion Cloud — such as creating and approving the same transaction, or maintaining supplier bank details and processing payment — are correctly evaluated against the customer's own configured SoD ruleset, that mitigating controls behave as designed where used, and that conflict status correctly changes after a role grant, role removal or organizational transfer, using masked/synthetic test data throughout — a comprehensive catalog of 25 individual Segregation of Duties test scenarios within the Security cluster.

Test ID	ORCL.SEC.SOD
Application	Oracle Fusion Cloud
Product	Security
Module	Security
Process	Segregation of Duties
Business Flow	Ruleset-Design-to-Conflict-Mitigation
Scenario Type	Positive / Negative / Security
Test Usage	Functional Testing / Regression Testing / UAT Sign-Off
Priority	High
Automation	SyntraFlow Ready
Library	Syntra Standard

Note on test design: SyntraFlow executes the detailed Oracle Fusion role assignment, transaction creation, approval and SoD analysis interactions automatically while presenting the scenario as business-readable test steps for documentation, review and reporting. This scenario is presented as 8 business-readable test steps; SyntraFlow's automation executes approximately 27 underlying Oracle Fusion UI actions to complete it.

Test Objective

This test validates conflicting-duty combinations — for example Create Supplier plus Pay Supplier, or Create AP Invoice plus Approve Invoice — against Oracle Fusion Cloud's security configuration, confirms mitigating controls behave as designed where the customer uses them, and confirms conflict status correctly re-evaluates after a role change, using masked/synthetic test data. Potential conflict patterns depend on customer control design and SoD policy — this catalog treats no duty combination as a fixed, one-size-fits-all restriction imposed by Oracle or by a generic industry standard.

The scenario should confirm that:

a user holding a conflicting-duty combination that the customer's SoD ruleset defines as a conflict is correctly flagged, blocked, or routed to a mitigating control, according to that customer's own configuration
a user holding a combination the customer's SoD ruleset does not define as a conflict is correctly permitted to perform both duties, without an assumed universal restriction being applied
where a mitigating control is configured for an approved conflict, the control's evidence (for example a compensating review or secondary approval) is correctly required and recorded rather than silently bypassed
conflict status correctly changes when a new role is granted, when a conflicting role is removed, or when a user is transferred between organizations, business units or positions
a user cannot approve, post or self-authorize their own transaction where the customer's configuration requires an independent approver
Segregation of Duties behavior remains consistent after an Oracle quarterly update, and that any apparent new or removed conflict is correctly attributable to the update rather than an unrelated data or configuration change
an apparent conflict flagged by automated analysis can be reviewed and, where the customer's own analysis determines it is not an actual conflict for their process, correctly treated as a false positive rather than an application defect
SoD evaluation reflects the customer's own configured ruleset, role design and duty definitions rather than a universal Oracle-enforced conflict matrix

A negative or security Segregation of Duties scenario passes when Oracle correctly enforces the outcome defined by the customer's own configured SoD ruleset — a block, a required mitigating control, or a permitted combination — not when a specific duty pair is denied in every environment. This page catalogs 25 individual Segregation of Duties scenarios as a single comprehensive reference rather than as separate indexable pages. All user, role and transaction values referenced throughout are ${PLACEHOLDER} tokens or explicitly masked test data, never real access grants or real conflict findings.

When to Use This Test

Functional testing of conflicting-duty combinations and mitigating controls during a new Oracle Fusion security or SoD policy implementation
Regression testing of SoD behavior after an Oracle quarterly update affecting security, workflow or approval rules
UAT sign-off for conflicting-duty combinations, mitigating-control evidence, self-approval prevention and conflict regression across the Security scenario catalog
Security and audit validation referenced by Role Assignment, Privilege Validation and Access After Transfer within the same Security cluster
Comprehensive scenario coverage for teams standardizing on a single Segregation of Duties regression pack instead of dozens of near-duplicate scripts

Where This Test Fits in the Ruleset-Design-to-Conflict-Mitigation Process

Define SoD Ruleset & Conflicting Duty Pairs

→

Detect Potential Conflict

→

Apply & Verify Mitigating Control

→

Re-Evaluate After Role or Organization Change

Segregation of Duties is one of the later scenario families in the Security cluster. It exercises conflicting-duty combinations across Financials, Procurement, HCM and Security administration, mitigating-control evidence, and conflict regression after role grant, role removal, organizational transfer and Oracle quarterly updates, and connects to Role Assignment, Privilege Validation and Access After Transfer within the same cluster. Which specific duty pairs are treated as conflicts, and whether a mitigating control is available for an approved conflict, depends entirely on the customer's own configured Oracle Fusion security and SoD policy — no universal conflict ruleset is assumed.

← Previous Stage

Privilege Validation

Next Stage →

Access After Transfer

Preconditions

Oracle Fusion Security Console access is available to a test user with user, role and SoD policy administration privileges.
A representative SoD ruleset with one or more conflicting-duty pairs is defined or can be constructed in the target Oracle Fusion environment, reflecting the customer's own control design.
Test users are available to represent ${USER} personas that hold a single duty, hold both duties in a conflicting pair, and hold an approved conflict with an associated mitigating control.
Representative ${ROLE} definitions exist for each duty under test (for example Create Supplier, Pay Supplier, Create AP Invoice, Approve Invoice).
Where the customer uses mitigating controls, a documented mitigating-control definition and evidence-capture mechanism (for example a compensating review workflow) is available for testing.
A valid ${BUSINESS_UNIT} and ${LEGAL_EMPLOYER} are configured in the target Oracle Fusion environment for scoping conflicting transactions.

Exact conflicting-duty pairs, SoD ruleset definitions and mitigating-control mechanisms vary by Oracle Fusion implementation and customer-specific SoD policy; no universal conflict ruleset is assumed. All user, role and transaction values used in testing are masked/synthetic DataVault data.

Sample Test Data

User	${USER}
Conflicting Role Pair	${ROLE_A} / ${ROLE_B}
Duty Pair Under Test	${DUTY_PAIR}
SoD Ruleset / Policy	${SOD_RULESET}
Mitigating Control	${MITIGATING_CONTROL}
Business Unit	${BUSINESS_UNIT}
Legal Employer	${LEGAL_EMPLOYER}
Transaction Reference	${TRANSACTION_ID}

Sample values are illustrative ${PLACEHOLDER} tokens, not real user, role or conflict data. Replace them with valid user, role and SoD ruleset data from the target Oracle Fusion TEST or UAT environment; not every field applies to every scenario. All user, role and transaction data are masked/synthetic — never real access grants or real conflict findings.

Test Steps

8 business-readable steps. SyntraFlow's automation executes ~27 underlying UI actions to complete these steps — see How SyntraFlow Automates This Test.

#	User Action	Expected Result
1	Sign In as Security Administrator Sign in to Oracle Fusion Cloud with a user account that has Security Console and SoD policy administration access.	The Oracle Fusion Cloud home page and SoD policy area load successfully for the authenticated security administrator.
2	Confirm Conflicting Duty Pair and SoD Ruleset Confirm or configure ${DUTY_PAIR} as a conflict within ${SOD_RULESET}, according to the customer's own control design. ${DUTY_PAIR} / ${SOD_RULESET}	The duty pair and its treatment (block, mitigate or permit) are correctly reflected in the configured ruleset.
3	Provision Test User with Conflicting Roles Provision ${USER} with ${ROLE_A} and ${ROLE_B}, or confirm the existing assignment, via the Security Console. ${USER} / ${ROLE_A} / ${ROLE_B}	The role assignments are created or confirmed successfully.
4	Perform the First Conflicting Transaction As ${USER}, perform the first duty in ${DUTY_PAIR} (for example create a transaction) within ${BUSINESS_UNIT}. ${BUSINESS_UNIT} / ${TRANSACTION_ID}	The first transaction step completes and produces a record capable of being approved, paid or posted.
5	Attempt the Second Conflicting TransactionBusiness assertion As the same ${USER}, attempt the second duty in ${DUTY_PAIR} against the same record (for example approve, pay or post it). ${TRANSACTION_ID} Correctly applying the customer's own configured SoD outcome, rather than assuming a universal block, is the core business assertion across this catalog.	Oracle correctly applies the customer's configured outcome for this conflict — blocked, routed to mitigation, or permitted — for the attempted second duty.
6	Verify Mitigating Control Evidence Where ConfiguredBusiness assertion Where ${MITIGATING_CONTROL} applies to this conflict, confirm the required compensating review or secondary approval evidence is captured before the transaction proceeds. ${MITIGATING_CONTROL}	The mitigating control evidence is correctly required and recorded; the transaction does not silently bypass the configured control.
7	Apply a Role or Organization Change Grant a new conflicting role, remove an existing conflicting role, or transfer ${USER} to a different ${BUSINESS_UNIT} or ${LEGAL_EMPLOYER}. ${USER} / ${BUSINESS_UNIT}	The role grant, role removal or organizational transfer is applied successfully.
8	Verify Conflict Status Re-Evaluates CorrectlyBusiness assertion Confirm that ${USER}'s conflict status correctly reflects the role or organization change applied in the previous step. ${SOD_RULESET} Conflict regression after a role or organizational change is the main business assertion for the lifecycle scenarios in this catalog.	The conflict is correctly newly flagged, correctly cleared, or correctly retained, according to the customer's configured SoD ruleset.

Expected Results

Conflicting-duty combinations defined by the customer's SoD ruleset are correctly flagged, blocked or routed to a mitigating control.
Combinations not defined as conflicts by the customer's ruleset are correctly permitted, without an assumed universal restriction.
Mitigating-control evidence is correctly required and recorded where the customer configures a compensating control for an approved conflict.
Self-approval and self-authorization of a user's own transaction are correctly prevented where the customer's configuration requires an independent approver.
Conflict status correctly updates after a role grant, role removal or organizational transfer.
Apparent new or removed conflicts following an Oracle quarterly update are correctly attributable to the update, and reviewed false positives are correctly distinguished from genuine conflicts.

Key Validation Checkpoints

Conflicting-duty combination correctly evaluated against the customer's own configured SoD ruleset.
Permitted (non-conflicting) combinations correctly allowed without unintended restriction.
Mitigating-control evidence correctly required and recorded, not silently bypassed.
Self-approval of a user's own transaction correctly prevented where configured.
Conflict status correctly re-evaluated after role grant, role removal or transfer.
Quarterly-update regression and false-positive review correctly distinguished from genuine new conflicts.

Core Business Scenario

Segregation of Duties

Scenario Catalog

25 Scenarios

Business Steps

Test Data

DataVault-Driven

Execution

On-Demand / Scheduled / Batch

Automation

SyntraFlow Ready

Jarvis AI

Go Beyond the Standard Test with Jarvis AI

The Syntra Standard Test Library defines the core Segregation of Duties scenario. Jarvis AI can extend this scenario by systematically generating additional Positive, Negative and Security variations using customer-specific user, role and conflicting-duty data available through Syntra DataVault.

Teams do not need to manually construct dozens of near-identical conflict scenarios to cover every duty pair, persona and mitigating-control combination. Jarvis follows a consistent pipeline: it starts from a Standard Test such as Create AP Invoice + Approve Invoice, combines it with DataVault dimensions — User + Role + Data Role + Privilege + Business Unit — and produces a Blocked, Mitigation-Required or Permitted outcome for the customer's own configuration, without creating additional indexable pages. This is a strong differentiator for SyntraFlow: SoD coverage expands automatically as DataVault role and duty data grows, rather than requiring a new test to be written and published for every conflicting-duty combination.

From Standard Test to Executed Regression Pack

Security

Oracle Fusion Security test area.

Security Module

Scenario cluster covering User Access, Role Assignment, Privilege Validation and Segregation of Duties.

Scenario Family — Segregation of Duties

Conflicting-duty combinations, mitigating controls, self-approval prevention and conflict regression after role or organizational change.

Standard Test Scenarios

25 Syntra Standard Segregation of Duties scenarios covering Financials, Procurement, HCM, Payroll and Security-administration conflict pairs.

DataVault Personas & Data

Finance AP Manager Test Persona and supporting dimensions — User, Role, Data Role, Privilege, Business Unit, Legal Employer, Department, Ledger, Security Scope.

Jarvis AI Variations

Positive, Negative and Security variations generated from the standard scenarios.

Regression Packs

Selected variations grouped into an executable Segregation of Duties regression suite.

Scheduled Execution

Execute on demand or schedule the regression pack for unattended batch execution.

Failure Intelligence

Execution evidence classified into DATA_ERROR, CONFIGURATION_ERROR, SECURITY_ERROR, EXPECTED_VALIDATION, INTEGRATION_ERROR, AUTOMATION_ERROR, ENVIRONMENT_ERROR or APPLICATION_ERROR rather than assumed as an Oracle defect.

Rather than maintaining a separate test for every possible conflicting-duty pair, mitigating control and persona combination, SyntraFlow maintains one core Segregation of Duties scenario and allows Jarvis AI to generate Positive, Negative and Security variations using the customer's available role and duty test data.

AI-Generated Test Variations

The same Segregation of Duties business scenario can produce many test variations without creating separate public library pages. Below is a real slice of SyntraFlow's Build Scripts library, filtered to Security.

Positive Scenarios

Non-conflicting duty combination correctly permitted
Approved conflict correctly proceeds once mitigating-control evidence is captured
Conflict correctly cleared after a conflicting role is removed
Conflict status correctly retained where still applicable after a transfer
False-positive conflict correctly reviewed and documented
SoD behavior correctly consistent after an Oracle quarterly update

Negative Scenarios

Conflicting-duty combination correctly flagged or blocked per the customer's SoD ruleset
Self-approval of a user's own transaction correctly prevented
Mitigating-control evidence missing — transaction correctly held pending review
New conflict introduced by a role grant correctly detected
Existing conflict after an organizational transfer correctly retained rather than silently cleared
Unauthorized attempt to bypass a configured mitigating control correctly blocked

These are representative examples only. Which duty pairs are treated as conflicts, whether a mitigating control is available, and how conflict status responds to role and organizational change can depend on the customer's Oracle Fusion configuration and SoD policy — not every Oracle configuration behaves identically, and not every conflict or control shown here exists for every customer.

Generated Using Your DataVault Test Data

Generic test data rarely represents every conflicting-duty pair, mitigating control and persona combination in a real Oracle Fusion SoD configuration. Where connected, Jarvis can use approved test data available through Syntra DataVault — User, Role, Data Role, Privilege, Business Unit, Legal Employer and Mitigating Control — to construct realistic Segregation of Duties variations relevant to the customer's actual implementation.

Standard Library Definition

User                    ${USER}
Conflicting Role Pair   ${ROLE_A} / ${ROLE_B}
Duty Pair               ${DUTY_PAIR}
SoD Ruleset             ${SOD_RULESET}
Mitigating Control      ${MITIGATING_CONTROL}
Business Unit           ${BUSINESS_UNIT}
Legal Employer          ${LEGAL_EMPLOYER}
Transaction Reference   ${TRANSACTION_ID}

DataVault

Users and Roles
  Users with single-duty, conflicting-duty and approved-conflict-with-mitigation role assignments
Conflicting Duty Pairs
  Financials, Procurement, HCM, Payroll and Security-administration duty pairs defined by the customer's SoD ruleset
Mitigating Controls
  Compensating review and secondary-approval definitions with and without required evidence
Organization Scoping
  Business Unit and legal employer combinations used to scope conflicting transactions
Lifecycle Events
  Role grant, role removal and organizational transfer events used to test conflict regression
Security
  Users with and without an assigned mitigating control for an approved conflict

Jarvis AI Generates

Scenario 01 — Negative/Security: Create Supplier + Pay Supplier Conflict Flagged
Scenario 02 — Positive/Security: Approved Conflict Proceeds With Mitigation Evidence
Scenario 03 — Negative/Security: Self-Approval of Own Invoice Blocked
Scenario 04 — Positive/Security: Conflict Cleared After Role Removal
Scenario 05 — Negative/Integration: Conflict Retained After Transfer
Scenario 06 — Positive/Security: False-Positive Conflict Documented
...

All user, role and conflicting-duty data used in Segregation of Duties testing are masked/synthetic via DataVault — never real access grants or real conflict findings. This follows the same masked-only standard used across Security testing, including Role Assignment and Privilege Validation — see /datavault/data-masking/ for how DataVault protects user, role and duty data used to generate variations across the Segregation of Duties catalog.

Example Test Variations

A comprehensive catalog of 25 individual Segregation of Duties test scenarios spanning Financials, Procurement, HCM, Payroll and Security-administration conflicting-duty combinations, mitigating controls, self-approval prevention and conflict regression after role or organizational change. Filter or search below.

ID	Variation	Type	Key Difference	Execution
SEC-SOD-001	Create Supplier + Pay Supplier	Negative/Security	As ${USER} holding both Create Supplier and Pay Supplier duties for ${BUSINESS_UNIT}, confirm the combination is evaluated against ${SOD_RULESET} and correctly flagged, blocked or routed to mitigation.	SyntraFlow Ready
SEC-SOD-002	Maintain Supplier Bank + Process Payment	Negative/Security	As ${USER} holding both Maintain Supplier Bank Details and Process Payment duties, confirm the potential conflict is evaluated and handled per the customer's configured SoD policy.	SyntraFlow Ready
SEC-SOD-003	Create AP Invoice + Approve Invoice	Negative/Security	As ${USER} holding both Create AP Invoice and Approve Invoice duties for ${BUSINESS_UNIT}, confirm the combination is correctly evaluated against ${SOD_RULESET}.	SyntraFlow Ready
SEC-SOD-004	Create Invoice + Pay Invoice	Negative/Security	As ${USER} holding both Create Invoice and Pay Invoice duties, confirm the same user cannot silently complete the full cycle unless permitted by ${SOD_RULESET}.	SyntraFlow Ready
SEC-SOD-005	Create PO + Approve PO	Negative/Security	As ${USER} holding both Create Purchase Order and Approve Purchase Order duties, confirm the combination is correctly evaluated against ${SOD_RULESET}.	SyntraFlow Ready
SEC-SOD-006	Create Requisition + Approve Own Requisition	Negative/Security	As ${USER}, attempt to approve a requisition the same ${USER} created; confirm Oracle correctly applies the customer's configured self-approval rule.	SyntraFlow Ready
SEC-SOD-007	Create Journal + Approve/Post Journal	Negative/Security	As ${USER} holding both Create Journal and Approve/Post Journal duties for ${LEGAL_EMPLOYER}, confirm the combination is correctly evaluated against ${SOD_RULESET}.	SyntraFlow Ready
SEC-SOD-008	Create Customer + Create Credit Adjustment Where Relevant	Negative/Security	As ${USER} holding both Create Customer and Create Credit Adjustment duties, confirm the combination is correctly evaluated against ${SOD_RULESET} where the customer treats it as a conflict.	SyntraFlow Ready
SEC-SOD-009	Create User + Assign Own Role	Negative/Security	As ${USER} with user-administration access, attempt to assign a role to the same ${USER}'s own account; confirm Oracle correctly applies the customer's configured self-assignment rule.	SyntraFlow Ready
SEC-SOD-010	Assign Security Role + Approve Access	Negative/Security	As ${USER} holding both role-assignment and access-approval duties, confirm the combination is correctly evaluated against ${SOD_RULESET}.	SyntraFlow Ready
SEC-SOD-011	Hire Worker + Change Own Compensation Where Relevant	Negative/Security	As ${USER} holding both Hire Worker and Change Compensation duties, attempt to change compensation on the same ${USER}'s own worker record where applicable; confirm the correct configured outcome.	SyntraFlow Ready
SEC-SOD-012	Manager Initiates + Approves Own Compensation Action	Negative/Security	As a manager ${USER}, attempt to both initiate and approve a compensation action affecting the manager's own record; confirm Oracle correctly applies the customer's configured self-approval rule.	SyntraFlow Ready
SEC-SOD-013	Payroll Input + Payroll Approval Combination	Negative/Security	As ${USER} holding both Payroll Input and Payroll Approval duties, confirm the combination is correctly evaluated against ${SOD_RULESET}.	SyntraFlow Ready
SEC-SOD-014	Inventory Adjustment + Approval Where Separation Required	Negative/Security	As ${USER} holding both Inventory Adjustment and Adjustment Approval duties, confirm the combination is correctly evaluated against ${SOD_RULESET} where the customer requires separation.	SyntraFlow Ready
SEC-SOD-015	Buyer + Supplier Master Maintenance Combination	Negative/Security	As ${USER} holding both Buyer and Supplier Master Maintenance duties, confirm the combination is correctly evaluated against ${SOD_RULESET}.	SyntraFlow Ready
SEC-SOD-016	Role Conflict Detected	Security	Run SoD analysis against ${USER}'s current role assignments; confirm a genuine conflict defined by ${SOD_RULESET} is correctly detected and reported.	SyntraFlow Ready
SEC-SOD-017	Role Conflict Allowed Only With Approved Mitigation Where Configured	Positive/Security	As ${USER} with an approved conflict under ${MITIGATING_CONTROL}, confirm the conflicting duties can proceed only once the required mitigation evidence is present.	SyntraFlow Ready
SEC-SOD-018	Mitigating Control Evidence Validation	Positive/Security	Confirm ${MITIGATING_CONTROL} evidence (compensating review or secondary approval) is correctly captured and retrievable, and that the conflict cannot silently bypass it.	SyntraFlow Ready
SEC-SOD-019	Conflict Introduced by New Role	Negative/Security	Grant ${USER} a new ${ROLE_B} that combines with an existing ${ROLE_A} to form a conflict under ${SOD_RULESET}; confirm the new conflict is correctly detected.	SyntraFlow Ready
SEC-SOD-020	Conflict Removed After Role Removal	Positive/Security	Remove ${ROLE_B} from ${USER}, eliminating the conflicting combination; confirm the conflict is correctly cleared from subsequent SoD analysis.	SyntraFlow Ready
SEC-SOD-021	Existing Conflict After Transfer	Negative/Security	Transfer ${USER} to a new ${BUSINESS_UNIT} or ${LEGAL_EMPLOYER} while both conflicting roles remain assigned; confirm the conflict is correctly retained rather than silently cleared.	SyntraFlow Ready
SEC-SOD-022	Quarterly-Update SoD Regression	Positive/Security	Re-run the Segregation of Duties scenario catalog after an Oracle quarterly update; confirm any newly appearing or disappearing conflict is correctly attributable to the update rather than an unrelated change.	SyntraFlow Ready
SEC-SOD-023	False-Positive Conflict Review	Positive/Security	Review a conflict flagged by automated SoD analysis that the customer's own process determines is not an actual conflict; confirm it is correctly documented as a reviewed false positive.	SyntraFlow Ready
SEC-SOD-024	Unauthorized Self-Approval Prevented	Negative/Security	As ${USER}, attempt to approve a transaction the same ${USER} created, where the customer's configuration requires an independent approver; confirm Oracle correctly blocks the self-approval attempt.	SyntraFlow Ready
SEC-SOD-025	End-to-End Privileged Transaction Conflict	Negative/Security	As ${USER} holding create, approve and pay duties spanning a full transaction lifecycle, confirm each conflicting step is correctly evaluated against ${SOD_RULESET} rather than only the first step in the chain.	SyntraFlow Ready

Positive and Negative Security Testing

Positive Testing

Jarvis generates scenarios designed to confirm that Oracle Fusion correctly permits a duty combination, or correctly allows an approved conflict to proceed once mitigating-control evidence is captured, exactly as the customer's SoD ruleset defines.

Non-Conflicting Duty Pair + Valid Role Design → Both Duties Permitted and Correctly Scoped

Negative Testing

Jarvis can also generate scenarios that deliberately hold a conflicting-duty combination to confirm Oracle correctly blocks, flags or requires mitigation for the condition rather than silently permitting it.

Create Supplier + Pay Supplier Combination → Flagged or Blocked Per SoD Ruleset
Create AP Invoice + Approve Invoice Combination → Flagged or Blocked Per SoD Ruleset
Self-Approval of Own Transaction → Access Prevented
Approved Conflict Without Required Mitigation Evidence → Transaction Held Pending Review
New Conflict Introduced by Role Grant → Correctly Detected
Existing Conflict Silently Cleared After Transfer → Correctly Prevented (Conflict Retained)

A negative security scenario passes when Oracle correctly denies unauthorized access, blocks an unauthorized action, or restricts visibility exactly as the customer's security configuration requires.

Scenario	Oracle Outcome	Test Result
Non-conflicting duty pair performed by one user	Both duties permitted	PASS
Conflicting duty pair with no mitigating control configured	Second duty blocked	PASS
Approved conflict with mitigating-control evidence captured	Transaction proceeds with evidence recorded	PASS
Self-approval attempt on own transaction	Approval blocked	PASS
Unexpected application exception during SoD evaluation	Unexpected failure	FAIL

Turn AI-Generated Variations into a Regression Pack

Users can select generated Segregation of Duties scenarios and group them into reusable execution packs.

Segregation of Duties Regression Pack

Create Supplier + Pay Supplier
Create AP Invoice + Approve Invoice
Create PO + Approve PO
Create Requisition + Approve Own Requisition
Assign Security Role + Approve Access
Role Conflict Allowed Only With Approved Mitigation Where Configured
Conflict Introduced by New Role
Conflict Removed After Role Removal
Existing Conflict After Transfer
Unauthorized Self-Approval Prevented

Add Selected to Regression Pack(coming soon)Run Now(coming soon)Schedule(coming soon)

Run On-Demand or Schedule Automated Batch Execution

SyntraFlow can execute selected Segregation of Duties scenarios individually or as a batch. Users can schedule regression packs according to their testing cycle.

Once scheduled, SyntraFlow executes the selected Segregation of Duties scenarios unattended and records the outcome of each test and business assertion.

Run immediatelyNightly regressionWeekly regressionBefore releaseAfter configuration changesAfter environment refreshQuarterly Oracle update testingPre-UAT validation

Pack	Segregation of Duties Regression Pack
Schedule	Quarterly Oracle Update Testing
Tests	25 scenarios
Execution	Batch Mode
Start	9:00 PM
Environment	Oracle Fusion TEST
Status	Scheduled

Illustrative example — not a live schedule.

Review Results Across the Entire Test Pack

Users can drill from the regression pack into a scenario, its business steps, the underlying automation actions, and the evidence captured for each.

Illustrative example data — not actual production metrics.

Total Scenarios

Passed

Failed

Exceptions

Positive Tests

Negative Tests

175

Business Assertions

Regression Pack → Scenario → Business Step → Automation Action → Evidence

DataVault HCM Persona

Rather than generating variations from disconnected field values, Jarvis can draw on a DataVault persona built specifically for Segregation of Duties testing — a coherent Finance AP Manager who holds both a creating duty and an approving duty within Accounts Payable, so that conflict scenarios exercise a realistic, internally consistent conflict condition rather than an arbitrary or malformed role combination.

Persona: Finance AP Manager

User	${USER}
Role	${ROLE_A} + ${ROLE_B}
Data Role	${DATA_ROLE}
Privilege	${PRIVILEGE_CREATE} + ${PRIVILEGE_APPROVE}
BU	${BUSINESS_UNIT}
Legal Employer	${LEGAL_EMPLOYER}
Department	${DEPARTMENT}
Ledger	${LEDGER}
Security Scope	${SECURITY_SCOPE}
Sensitive Field	${SENSITIVE_FIELD}

DataVault personas keep user, role, data role and organization dimensions coherent, so Jarvis constructs realistic, internally consistent conflicting-duty scenarios without relying on arbitrary or conflicting field combinations.

SoD Conflict & Persona Variations

Oracle Fusion role design and SoD ruleset configuration are customer-specific, so SyntraFlow can exercise Segregation of Duties testing under different approved DataVault personas holding conflicting-duty combinations, to confirm the customer's own configuration behaves as expected, rather than assuming a universal Oracle-enforced SoD ruleset.

Persona	Action	Expected	Syntra Result
Finance AP Manager	Create AP Invoice, Then Attempt to Approve the Same Invoice	Second duty blocked or routed to mitigation per SoD ruleset	PASS
Finance AP Manager	Perform Approved Conflict With Mitigating-Control Evidence Captured	Transaction proceeds with evidence recorded	PASS
Procurement Buyer	Create Purchase Order, Then Attempt to Approve the Same PO	Second duty blocked or routed to mitigation per SoD ruleset	PASS
Line Manager	Initiate and Attempt to Approve Own Compensation Action	Self-approval prevented	PASS
Payroll Specialist	Enter Payroll Input, Then Attempt Payroll Approval on Same Record	Second duty blocked or routed to mitigation per SoD ruleset	PASS
Security Administrator	Create User Account, Then Attempt to Assign a Role to Own Account	Self-assignment prevented	PASS

Understand Why a Test Failed

SyntraFlow execution evidence can help distinguish business-data failures, configuration issues, automation problems and potential application defects.

DataConfigurationSecurityAutomationApplicationEnvironmentExpected Validation

Jarvis Failure Intelligence — Coming Soon

From Business Scenario to Execution Evidence

Business teams get readable test documentation; automation teams retain detailed execution traceability.

Standard Business Scenario

AI-Generated Variation

Regression Pack

Business Test Step

Automation Actions

Business Assertion

Screenshot / Evidence

Execution Result

Meet Jarvis — SyntraFlow's AI Testing Engine

Jarvis extends the Syntra Standard Test Library by analysing the Segregation of Duties scenario, available DataVault test data and expected business outcomes to systematically generate Positive, Negative and Security coverage for the customer's environment.

Generate

Positive, Negative and Security variations.

Parameterize

Use relevant user, role and duty data from DataVault.

Assemble

Build reusable regression packs.

Execute

Run scenarios autonomously.

Schedule

Execute unattended test batches.

Validate

Evaluate expected business outcomes.

How SyntraFlow Automates This Test

The Standard Test defines the scenario; DataVault, Jarvis AI and SyntraFlow's execution engine take it from a single reusable business definition to executed, evidenced regression coverage.

Standard Library — Segregation of Duties, 8 Business Steps

↓

DataVault — Security Persona-Specific Test Data

↓

Jarvis AI — Generate Positive/Negative/Security Variations

↓

Regression Pack — Select Relevant Coverage

↓

SyntraFlow Execution — Each Variation

↓

Detailed UI Actions

↓

Business Assertions

↓

Evidence

↓

PASS / FAIL

Business Step → Underlying UI Actions

Business Step

Provision Test User with Conflicting Roles

May internally include

Navigate to Security Console → Users → Edit User → Assign ${ROLE_A} → Assign ${ROLE_B} → Save and Close

Business Step

Attempt the Second Conflicting Transaction

May internally include

Sign In as ${USER} → Navigate to Transaction Record ${TRANSACTION_ID} → Attempt Approve/Pay/Post Action → Capture Allowed/Blocked/Mitigation-Required Response

What SyntraFlow Captures Per Run

Parameterised input valuesReusable navigationAutomation action traceScreenshots / evidence captureExecution timingPass / fail statusBusiness assertionsEnvironment-independent test data

Action Status vs. Business Validation

A successful transaction action does not automatically prove the SoD outcome was correct — this is illustrative of how SyntraFlow separates action success from business validation; it does not reflect a specific live execution. Because this page aggregates 25 individual scenarios across conflicting-duty combinations, mitigating controls, self-approval prevention and conflict regression, evidence-based failure classification matters most here. When a step or business assertion fails, SyntraFlow's evidence is intended to help classify the likely cause into one of eight categories — DATA_ERROR, CONFIGURATION_ERROR, SECURITY_ERROR, EXPECTED_VALIDATION, INTEGRATION_ERROR, AUTOMATION_ERROR, ENVIRONMENT_ERROR or APPLICATION_ERROR — rather than assuming a defect. For example: a user is unexpectedly allowed to perform both duties — Likely category: CONFIGURATION_ERROR or SECURITY_ERROR — Evidence: ${SOD_RULESET} does not define ${DUTY_PAIR} as a conflict, or the role design grants both duties through a single ${ROLE} — Recommended action: verify the SoD ruleset and role design before treating the result as an Oracle defect. A failure should not be labeled as an Oracle application defect until data, configuration, security, automation and integration causes have been eliminated.

Step	Action Status	Business Validation
Provision Test User with Conflicting Roles	Pass	—
Perform the First Conflicting Transaction	Pass	—
Attempt the Second Conflicting Transaction	Pass	Pass

Related Security Tests

Segregation of Duties covers 25 individual scenarios that connect to Role Assignment, Privilege Validation and Access After Transfer within the same Security cluster.

Role Assignment Privilege Validation Access After Transfer

Turn This Standard Test into Your Oracle Fusion Segregation of Duties Regression Suite

Start with the Syntra Standard Segregation of Duties test, use DataVault to provide environment-specific user, role and conflicting-duty data, let Jarvis generate additional Positive, Negative and Security variations, and execute the resulting regression pack automatically with SyntraFlow.

Automate with SyntraFlow Explore Security Test Library

Use This Oracle Fusion Test Case

Download Test Case

Excel, CSV or JSON export.

Coming soon

Automate with SyntraFlow

Run this script against your own tenant today.

Related Oracle Testing Resources

Oracle ERP Testing Tool Test Library Security Test Library Role Assignment Privilege Validation Access After Transfer SyntraFlow Continuous SoD Monitoring Syntra DataVault

Frequently Asked Questions

Does SyntraFlow assume a fixed, universal list of Oracle Segregation of Duties conflicts?

No. Potential conflict patterns depend on customer control design and SoD policy. This catalog tests whether the customer's own configured SoD ruleset in Oracle Fusion Cloud behaves as that customer defined it — flagging, blocking or routing a combination to mitigation exactly as configured — rather than assuming Oracle enforces a universal SoD ruleset out of the box or that a specific duty pair is prohibited in every environment.

What is the difference between this Segregation of Duties catalog and the separate SyntraFlow SoD product page?

This page is one family within the Test Library's Security cluster: 25 individual test scenarios covering conflicting-duty combinations, mitigating controls and conflict regression, executed on demand or in a regression pack. SyntraFlow's dedicated Segregation of Duties product page at /oracle-fusion-segregation-of-duties/ describes continuous SoD monitoring capability more broadly. The two are complementary but distinct: this page is a test-case reference, the product page describes the monitoring capability.

How does SyntraFlow test mitigating controls?

Scenarios SEC-SOD-017 and SEC-SOD-018 confirm that, where a customer has configured a mitigating control for an approved conflict, the required compensating review or secondary-approval evidence is captured and cannot be silently bypassed. Whether a mitigating control is available for a given conflict, and what evidence it requires, depends entirely on the customer's own control design.

How does SyntraFlow test conflict status after a role or organizational change?

Scenarios SEC-SOD-019 through SEC-SOD-021 deliberately introduce a new conflicting role, remove a conflicting role, and transfer a user between organizations, then confirm the resulting conflict status — newly flagged, cleared or retained — correctly reflects the customer's configured SoD ruleset rather than a stale prior state.

How does SyntraFlow handle SoD regression after an Oracle quarterly update and potential false positives?

Scenario SEC-SOD-022 re-runs the SoD scenario catalog after a quarterly update and treats any newly appearing or disappearing conflict as a finding to investigate rather than an assumed defect. Scenario SEC-SOD-023 confirms that a conflict flagged by automated analysis can be reviewed and, where the customer's own analysis determines it is not an actual conflict for their process, correctly documented as a false positive.

How does SyntraFlow classify a failed Segregation of Duties test?

When a step or business assertion fails, SyntraFlow's evidence is intended to help classify the likely cause into one of eight categories — DATA_ERROR, CONFIGURATION_ERROR, SECURITY_ERROR, EXPECTED_VALIDATION, INTEGRATION_ERROR, AUTOMATION_ERROR, ENVIRONMENT_ERROR or APPLICATION_ERROR — along with supporting evidence and a recommended action. For example, a user unexpectedly permitted to perform both conflicting duties is likely a CONFIGURATION_ERROR or SECURITY_ERROR in the ruleset or role design. A failure should not be labeled as an Oracle application defect until data, configuration, security, automation and integration causes have been eliminated.