Virsa Mitigatin rules

As a new person to Virsa, how do you setup mitigation rules within Virsa e.g. Virsa does not like users who can create purchase requisitions and release them. But if that is an integral part of that person's job - how do you stop Virsa from reporting it?

Many thanks

Brian