Lean Separation of Duties is the discipline of enforcing clear, minimal, and effective boundaries between who can do what in your system. It strips away bureaucracy, yet keeps the guardrails that stop accidental or malicious changes. Done right, it secures your workflows without slowing deploys. Done wrong, it opens gaps attackers and errors can exploit.
Traditional Separation of Duties often means sprawling approval chains and multiple people in multiple departments signing off on every change. Lean Separation of Duties takes the core principle—no single entity can do everything—and implements it with the smallest practical set of roles, permissions, and review steps. This keeps velocity high while keeping control tight.
The key is defining permissions at the exact points where risk spikes: code merges, production deploys, infrastructure changes, and access to sensitive data. Engineers should be able to ship, but not bypass review of security-critical code. Operations should be able to roll out changes, but not approve untested builds. Auditors should be able to trace every action to an accountable identity.