When a user is added to a role using Role Membership Maintain (36.3.6.6), the system runs checks to validate that the roles to which the user belongs to have compatible segregation of duties categories (Rule 2 validation). If the roles have incompatible segregation of duties categories and Rule 2 is violated, the system blocks the role membership update and displays an error.

If you remove a user from a role, the system runs checks before and after the update to determine the status of role membership violations. If the deletion fixes an existing violation, the system creates entries in the segregation of duties log to reflect this.

When the SOD Block All Rule Violations field is selected in SOD Configuration (36.3.27.14), you are blocked from performing steps that violate role membership compatibility.