Context-dependent transactional management for separation of duties

A computer program product for providing a context-dependent firewall for an organization, the computer program product comprising:

• a non-transitory storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising:
• creating a partitioned graph representing the organization and one or more business rules, wherein each of the business rule includes one or more separation of duties requirements;
• determining a use context associated with the partitioned graph based on the one or more separation of duties requirements;
• determining one or more confidence levels associated with a blocking action related to the use context, wherein the blocking action is indicative that the use context violates one of the one or more separation of duties requirements;
• and
• creating the context-dependent firewall based on the one or more confidence levels associated with the blocking action.

A processing system for providing transactional management of services within a cloud environment, the processing system comprising:

• a processor in communication with a storage device and a network adapter, the processing system configured to perform a method comprising:
• receiving a request to create a business rule for controlling transaction with a cloud service for an organization;
• providing an instance of the cloud service for provisioning the business rule by generating a partitioned graph representing the organization and the business rule, wherein the business rule includes one or more separation of duties requirements;
• receiving an access request from an end user of the cloud service;
• determining if the access request to the cloud service violates any of the one or more separation of duties requirements;
• based on determining that the access request to the cloud service does not violate any of the one or more separation of duties requirements, granting the end user transaction with the cloud service;
• and
• based on determining that the access request to the cloud service violates one of the one or more separation of duties requirements, denying the end user transactional access to the cloud service.