Administrative Roles & Separation of Duties
Role hierarchy (SUPER_ADMIN, IT_ADMIN, COMPLIANCE_OFFICER, EXEC_MANAGER, DEPT_HEAD, BROADCASTER, MEMBER) and Separation of Duties enforcement.
Strict Separation Between IT Operations and Compliance
Madar enforces Separation of Duties (SoD) at the API and database levels:
- Mutual Exclusion: A single user account cannot be assigned both IT_ADMIN and COMPLIANCE_OFFICER roles simultaneously (rejected with 400 sod_role_conflict).
- Retention Policy Protection: IT_ADMIN can manage devices, departments, and DLP policies, but is blocked (403 Forbidden) from modifying retention.* policies; only COMPLIANCE_OFFICER or SUPER_ADMIN can alter retention rules.
- Dual-Control Break-Glass: Emergency inspection of governed records requires initiation by one authorized officer and approval by a distinct second officer.