Segregation of Duties (SoD)
Rules that flag toxic combinations of access — like being able to both create a vendor and approve payments to it — usually created by overlapping entitlements.
aka: SoD, separation of duties
SoD violations are often a byproduct of privilege creep rather than a deliberate grant — nobody sets out to give one person conflicting powers, it happens gradually as roles accumulate. The classic example, create-vendor plus approve-payment in an ERP system, exists because either action alone is safe, but together they enable fraud with no second person required.