RBAC and why roles stop scaling

Role-based access control is the model most developers meet first, and usually the one already in place wherever you work. Permissions attach to roles, roles attach to people, and nobody manages individual grants. It scales with headcount beautifully, and it is worth understanding exactly where it stops.

• A permission is an action on a resource: read a secret, deploy a service, approve a payment.
• A role is a named bundle of permissions: on-call engineer, billing admin.
• An assignment binds a principal to a role, usually for as long as they hold a job.

The reason RBAC won is administrative rather than technical. When someone changes teams you change one assignment, not forty grants, and when an auditor asks who can approve payments you read one role rather than reconstructing it.

Role explosion is the characteristic failure, and it arrives the same way every time. A role nearly fits someone, so a variant is created. Then a variant of the variant. Within two years there are more roles than people, each held by one person, and the model has quietly degraded into per-user grants with extra indirection.

• The warning sign is roles whose names contain a team, a person, or a project.
• The measurement is the ratio of roles to principals. Approaching one to one means the model has stopped working.
• The cause is almost always that context is being encoded into role names, because the model has nowhere else to put it.

For agents, RBAC breaks differently and more seriously. Roles model durable job functions, and an agent's justified access is narrow, short-lived and specific to a task. Giving an agent the deploy-bot role grants it whatever that role accumulates over time, from every future change made for reasons unrelated to it.

• A human's access is stable for months; an agent's is often justified for minutes.
• A human holds one role across many tasks; an agent should hold different access per task.
• A human can be asked why they used a permission; an agent used it because its input said so.

The models compose rather than compete. Most working systems are RBAC for coarse organisational structure, ABAC conditions for context, and per-principal policies for the machine identities that do not fit either.