An analysis writes a summary report, a detailed report, and a signed execution log. Users mode and roles mode produce different columns, because the analyzed entity differs, so there are four report layouts in total. All are tab-separated and open in any spreadsheet application.
Summary report, users analysis
One row per user and risk. This is the working list for remediation and certification.
User ID, Local User ID, Full Name, Department, HR Function, Location, Additional Scope, Access Risk ID, Risk Owner, Risk Description, Risk Level, Risk Type, Ruleset, Business Process, Did-do
The five HR columns are populated only when an HR_DATA file is loaded. Did-do is populated only when Did do was enabled on the run.
User ID is the canonical identity and Local User ID is the account in the individual system. They differ only when a cross-system mapping is in place, where one person holding three accounts appears under one canonical ID. See Cross-System Analysis.
Summary report, roles analysis
One row per role and risk.
Role Name, Access Risk ID, Role Description, Role Type, Risk Owner, Risk Description, Risk Level, Risk Type, Ruleset, Business Process, Did-do
Detailed report, users analysis
Twenty-four columns, one row per authorization that contributes to a conflict. This is the evidence layer: it shows which role granted which value on which object.
User ID, Local User ID, User Group, Access Risk ID, Risk Owner, Risk Description, Risk Level, Risk Type, Function, Function Description, System, Action, Action Description, Resource, Resource Extn, Value From, Value To, Role/Profile, Role/Profile Description, Composite/Business Role, Composite Role Description, Business Role, Business Process, Simulation
| Column | Meaning |
|---|---|
Function / Function Description | The ruleset function this row satisfies. An SoD risk needs two or more distinct functions |
Action | The action, meaning the permission group in the ruleset, not necessarily a transaction code |
Resource | Authorization object |
Resource Extn | Authorization field within that object |
Value From / Value To | The value or range the user actually holds |
Role/Profile | The single role or profile granting it |
Composite/Business Role | The composite role, or the IAM business role, that delivered the single role |
Business Role | The IAM business role, when IAM analysis is enabled |
Simulation | Added, Removed, or empty for unchanged. Populated only on a simulated run |
Because there is one row per contributing authorization, a single risk on a single user commonly spans dozens of rows. Expect this report to be large: it is designed to be filtered, not read.
Detailed report, roles analysis
Twenty-two columns, identical to the users layout except that Role Name replaces User ID, Local User ID and User Group.
Role Name, Access Risk ID, Risk Owner, Risk Description, Risk Level, Risk Type, Function, Function Description, System, Action, Action Description, Resource, Resource Extn, Value From, Value To, Role/Profile, Role/Profile Description, Composite/Business Role, Composite Role Description, Business Role, Business Process, Simulation
Risk level and risk type values
Neither is a fixed list. Both carry through verbatim from the loaded ruleset, and the filter options offered in the interface are assembled from the distinct values found there. A ruleset using Critical, High, Medium, Low produces those four; one using 1 to 5 produces those. Likewise Risk Type is whatever the ruleset declares, commonly Segregation of Duties, Critical Action, or Critical Permission.
This matters when comparing reports produced against different rulesets: the levels are only comparable if the rulesets agree on them.
Execution log
Every analysis writes a .log file next to the reports, Ed25519-signed so it can serve as audit evidence. It records the version and build, the licensed organization, start and completion timestamps, the full analysis criteria, any simulation criteria, and the SHA-256 checksum and row count of the ruleset and of each data source table.
See How Log Signing Works and the IT Auditor Verification Guide.