Failure modes
When automation collapses maker-checker
Maker-checker looks healthy on a flowchart and still fails in production when both sides of the check run as the same machine identity. Below are four collapse modes we see repeatedly in API-driven accounting stacks.
1. Shared service principal
The bot that creates a payment instruction also holds the scope to approve it “for speed.” Humans never click approve; the control exists only as a comment in a design doc.
2. Config deployer equals poster
CI can change connector mapping and then run the connector. One compromised pipeline identity rewrites rules and posts under the new rules in the same hour.
3. Webhook fan-in to one inbox
Approval events and posting confirmations land in a single automation mailbox that auto-forwards to a script with both duties. Logs show activity; they do not show separation.
4. Break-glass that never expires
Emergency roles created for month-end stay attached to standing accounts. The exception process becomes the normal path, and the matrix still claims duties are split.
None of these require exotic attackers—only convenience. The fix pattern is boring: separate principals, time-box exceptions, and put compensating detection on anything you cannot split this quarter. We workshop these modes inside API SoD Control Matrix Module 6.