Role explosion
Role explosion is what happens when an RBAC model becomes so granular that it needs a very large number of roles to describe every situation in the organisation.
- Synonym
- role proliferation
Definition
Role explosion appears when a role model tries to represent every possible combination of business function, country, entity, site, level of responsibility, application, population and exception. An Accountant role becomes Accountant France, then Accountant France head office, then Accountant France head office approver. The catalogue then becomes hard to understand, to assign, to maintain, to audit and to evolve. Role explosion is a modelling symptom: it says that context has been pushed into role names instead of being evaluated where it belongs.
Why it matters
A role catalogue nobody can read is a governance catalogue nobody can certify. Role explosion turns recertification, onboarding and audit into guesswork.
The Ariovis perspective
A role should represent something stable and shareable. RBAC is not meant to model every dimension of context. When combinatorics take over, keep roles for the structural part and complete the model with attributes, relationships or dynamic authorization policies.
Related services
Common pitfalls
- Confusing role explosion with privilege accumulation: an organisation can have thousands of very restrictive roles while each user still holds very few rights.
Standards and protocols
- NIST RBAC (INCITS 359)
Resources
Explore this category
These concepts matter most inside a real project.
The first conversation helps establish your context, the systems involved and the next useful decision.