Role explosion occurs when a system accumulates too many narrowly defined roles to satisfy increasingly specific access requests. A simple pair such as user and admin can grow into roles like invoice_admin, invoice_contract_admin, and regional_editor_eu. The result is a role list that becomes difficult to manage, name, audit, and interpret. section 17.1.1
How the role list grows
An organization first creates admin, then adds invoice_admin when someone needs invoice access without user management. Later, invoice_contract_admin handles invoices and contracts, while invoice_approver_eu or contract_editor_fr address regional differences. As these roles multiply, administrators may assign them simply to make access work without understanding the permissions granted. section 17.1.1 section 17.3
Role explosion is a common limit of role-based access control (RBAC). RBAC remains useful when a few well-designed roles match responsibilities, but it handles contextual decisions poorly, such as restricting access by department, region, resource, or request time. Attribute-based access control (ABAC) can express those conditions directly, while relationship-based access control (ReBAC) uses connections between entities. section 17.1.1 section 17.3
Figure 17.2 Roles and their associated permissions in RBAC. Each role represents a bundle of permissions. A user assigned to a role automatically inherits all the permissions granted by that role. This structure simplifies access control but can become difficult to manage as permission needs grow more specific.
Shows how each RBAC role bundles permissions and why increasingly specific permission needs make the structure harder to manage. section 17.1.1
