A toxic combination is a set of access rights that creates unacceptable risk when held together. The combination may enable fraud, unauthorized change, concealment, privacy breach or circumvention of a control even when each entitlement is legitimate on its own.
IGA represents toxic combinations as SoD or access-risk policies and can prevent assignment, require exception approval or detect existing violations.