OpenChainGraph Suite · ART-459 · SOX 404 / ICFR Access Controls

Segregation-of-Duties Matrix Checker

Evaluates a role-assignment set against a conflict ruleset for SOX 404 / ICFR access controls. For every user, checks every pair of assigned roles against the ruleset and returns any conflicts found. The ruleset is your own versioned policy input — this tool never derives or guesses which role pairs conflict.

SoD Conflict Matrix Deterministic Pairwise Check

🔒 All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only, e.g. opaque user IDs.

Load a Preset

Presets fill the ruleset and assignments below — nothing runs until you click Check SoD Matrix.

Avalanche subnet-EVM precompile grants use a role lattice: None < Enabled < Manager < Admin, where Admin and Manager both confer the Enabled capability. Record each grant at the level the genesis actually states (e.g. txallowlist:admin) — never flatten it to enabled. The correct preset enumerates every level pairing into the ruleset so this lattice is never inferred by the tool. The second preset shows what happens when it isn't: the exact same grants, checked against a ruleset written only at the Enabled floor, come back clean with no conflicts flagged — a false-green receipt over a genesis riddled with concentration.

SoD Matrix Inputs

Ruleset version

Conflict ruleset (JSON array of {"role_a","role_b","reason_code"})

Role assignments (JSON array of {"user_id","roles":[...]})

Conflicts

Execution Hash (SHA-256)

Ask your agent

Copy this paragraph into Claude, OpenClaw, or any MCP-aware agent to run this exact tool, with this sample, and verify the artifact.

Run the AINumbers MCP tool `check_sod_matrix`. Task: Evaluate a caller-declared role-assignment set against a caller-declared SoD conflict ruleset for SOX 404 / ICFR access controls.
Synthetic sample input (policy_parameters): {"ruleset_version":"sod-ruleset-v1","conflict_ruleset":[{"role_a":"AP_ENTRY","role_b":"AP_APPROVE","reason_code":"SOD_AP_ENTRY_APPROVE"}],"assignments":[{"user_id":"u1","roles":["AP_ENTRY"]},{"user_id":"u2","roles":["AP_APPROVE"]}]}
Verify before trusting: call `verify_execution_hash` on mcp.ainumbers.co (https://mcp.ainumbers.co/mcp) with the returned execution_hash.
Return the ledger link https://ledger.ainumbers.co/ so a human can re-verify without contacting us.
PII rule: All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only.
Open the tool with the sample prefilled: https://ainumbers.co/chaingraph/art-459-sod-matrix-check.html#p=v1.H4sIAAAAAAAA_wHoABf_eyJydWxlc2V0X3ZlcnNpb24iOiJzb2QtcnVsZXNldC12MSIsImNvbmZsaWN0X3J1bGVzZXQiOlt7InJvbGVfYSI6IkFQX0VOVFJZIiwicm9sZV9iIjoiQVBfQVBQUk9WRSIsInJlYXNvbl9jb2RlIjoiU09EX0FQX0VOVFJZX0FQUFJPVkUifV0sImFzc2lnbm1lbnRzIjpbeyJ1c2VyX2lkIjoidTEiLCJyb2xlcyI6WyJBUF9FTlRSWSJdfSx7InVzZXJfaWQiOiJ1MiIsInJvbGVzIjpbIkFQX0FQUFJPVkUiXX1dfYZ85DjoAAAA