Delegation of Authority Matrix Validator
For whoever owns the approval matrix before the auditor asks who can approve what

Paste your delegation of authority matrix. See who can approve their own request.

Delegation of Authority Matrix Validator reads your approval matrix line by line for segregation of duties conflicts, second approvers and the limits between one role and the next. Paste your delegation of authority matrix, roles not names. Get every approval line checked for self-approval, missing second approvers, limits higher than the role above, gaps between amount bands, the vendor-change-and-payment pair, delegations with no end date, and the lines an AI agent or automation could execute with no human approver, each with the clause behind it.

Paste roles, not names. The matrix is read in your browser and nothing is stored until you save.

What it does. It checks the lines against the rules below and shows the clause behind each finding. It never certifies a matrix, approves anything, or gives legal advice.

Check your own matrixEight lines free, no account. A published dictionary of 40 approval families, the role ranks and the clause text load with the page; every check runs in your browser.
Specimen: an invented industrial distributor2 of its 21 ladders
Purchase ordersUSD
  1. above 250KCFO and CEOline 3
  2. 50K to 250KFinance Directorline 2
  3. 25K to 50Kno approver
  4. up to 25KHead of Departmentline 1
Payment run releaseUSD
  1. up to 2MAP Manager and Treasury Managerline 8
  2. up to 1MFinance Directorline 9

40 approval lines, 9 segregation of duties conflicts.

3 self-approvals, 6 conflicting duties held by one role, 1 gap between bands, 1 line no human approves.

Two colleagues at a desk reading printed schedules, one with a pen, the other turning the pages of a file
Walk into the audit knowing which line lets one role approve its own request, and which clause says so. It works from the matrix you already keep in a spreadsheet, so there is no approval software to buy, no names to hand over and no consultant's review to wait weeks for.
01

Paste the matrix as it comes out of the spreadsheet

One approval line per row: the approval, the approver role and the limit, or with any of raised by, second approver, delegate, delegation ends, automation, level and last reviewed. Each line is placed on one of 40 published approval families; a line that matches none is marked unmatched and never guessed.

02

Read the authority ladders

For each kind of approval, the bands in amount order with the approver on each rung, rising to the board. A range no line covers is drawn as an empty dashed rung; a line that raises a segregation of duties conflict carries a crimson bar in its margin.

03

Take the walkthrough pack to the matrix owner

Eleven findings in fixed order, each with the lines it names, the clause quoted from COSO, SOX 404, ISO/IEC 27001, NIST SP 800-53, COBIT, the EU AI Act, GDPR or ISO/IEC 42001, and the question to put to the matrix owner.

One approval line per row: Approval | Approver | Limit, or a header row with any of Raised by, Second approver, Delegate, Delegation ends, Automation, Last reviewed. Tabs, pipes, commas or double spaces, or lines in words such as Purchase orders up to 25,000: Head of Department. A first line such as listed: yes | EU or UK: yes | board reserved above: 1M | as at: 2026-09-25 sets the company and the date.
Nothing is sent anywhere until you choose to save.
The company (sets which clauses are quoted)

Why a ladder and not another review

Approval software sells a workflow to companies that can buy one. The controller at a 600-person company still answers the auditor from a spreadsheet of approval limits last read at the previous audit, and more of its lines are now executed by automations and AI agents than by the people it names. Before anyone redesigns the matrix, somebody has to show which lines let one role approve its own request, where the bands leave a gap, and which lines no human approves. That is what this draws, in your browser, from the matrix as it stands.

The dictionary is ours and published in full: every approval family in eight groups, the conflicting pairs of duties, the clauses each regime attaches and the columns a matrix needs. It reads roles only: a name or an email in the paste is masked before anything is shown, and a conflict is a question for the matrix owner, not a verdict.