# Role-Based Access Control (RBAC) / Role Explosion

> "role-based-access-control" (security-core layer) is traded against "Role Explosion" (security-core layer) — a principle cannot be scope-separated from a quality, metric, or cost it competes with; resolve by measuring "Role Explosion" and choosing an explicit operating point.

Record: `tension:role-based-access-control-rbac-role-explosion`
Kind: tension
Canonical: https://banes-lab.com/ontology/schema#tension-role-based-access-control-rbac-role-explosion

Listed in [Tensions](https://banes-lab.com/api/records/tension.md), after [Access Control / Usability](https://banes-lab.com/records/tension/access-control-usability.md) and before [Attribute-Based Access Control (ABAC) / Policy Complexity](https://banes-lab.com/records/tension/attribute-based-access-control-abac-policy-complexity.md).

## In tension with

- [Role-Based Access Control (RBAC)](https://banes-lab.com/records/architecture/role-based-access-control.md)
- [Role Explosion](https://banes-lab.com/records/lexicon/role-explosion.md)

## Mechanism

- [irreducible-tradeoff](https://banes-lab.com/records/vocabulary/resolution-mechanism-irreducible-tradeoff.md)

## Linked from

- [Security / Privacy / Compliance / Governance](https://banes-lab.com/ontology/principles/architecture-category-security-privacy-compliance-governance.md)
- [Resolution mechanisms](https://banes-lab.com/ontology/schema/the-vocabulary-resolution-mechanism.md)