Can we define segregation of duties rules, prevent new violations and detect pre-existing ones?

Hitachi ID Identity Manager supports segregation of duties (SoD) policies, whereby users are forbidden from being assigned more than M of a set of N entitlements, where M is less than N. Entitlements may consist of accounts on target systems, membership of accounts in groups on target systems or roles, which are collections of the former two. Policies are applied at request time, preventing users from acquiring policy-violating combinations of access rights and in the context of analytics, to find existing violations. Read more here: https://hitachi-id.com