Role-Based Access Control (RBAC) / Role Explosion
Kind: tension
Record: tension:role-based-access-control-rbac-role-explosion
Canonical: Schema
"role-based-access-control" (security-core layer) is traded against "Role Explosion" (security-core layer) — a principle cannot be scope-separated from a quality, metric, or cost it competes with; resolve by measuring "Role Explosion" and choosing an explicit operating point.
Listed in Tensions, after Access Control / Usability and before Attribute-Based Access Control (ABAC) / Policy Complexity.