Implementing segregation of duties and least privilege involves creating a risk-based conflict matrix to flag toxic permission combinations, mapping every entitlement to a specific business owner.