Answer
Check the dedicated Segregation of Duties Analysis section of the technical documentation under the security/administration area — this is maintained as its own documented capability with an analysis tool, not something to piece together from general permission-set guidance.