Role Explosion
RBAC's characteristic failure mode — minting a new, narrower role for every resource-specific exception until the role count rivals or exceeds the user count, defeating the whole point of roles.
Role explosion happens when a team tries to force resource- or context-specific conditions into the role model itself instead of recognizing those conditions belong in an attribute-based layer on top. The fix isn’t abandoning RBAC — it’s the hybrid pattern: a small, stable set of roles for coarse gates, with ABAC handling the situational logic roles were never meant to express.