Role-based access is dead. Here's what replaced it.

Role-based access control was a good idea for its time. Instead of granting permissions one by one, you group people into roles, assign permissions to the role, and everyone in that role inherits them. Clean, predictable, easy to explain to an auditor.

It worked because the assumption underneath it held: people have one job, and that job doesn't change much.

Where it starts to break

That assumption stopped being true a while ago. People move between teams. They cover for someone on leave. They pick up a project that needs access to a system they've never touched. Contractors come in for six weeks and need three tools, two of which nobody thought to include in the contractor role.

What happens next is predictable. Someone creates a one-off exception. Then another. Six months later you have forty roles, half of them variations of each other, and nobody can explain what "Engineering - Ops (Legacy)" actually grants.

Pull quote:

Role sprawl isn't a sign the team got sloppy. It's a sign the model stopped fitting.

The permission creep problem

The bigger issue isn't the number of roles. It's that access only ever moves in one direction.

• Someone gets added to a role for a project, and stays after it ends

• A role picks up a new permission for one person's edge case, and everyone in it inherits it

• Nobody audits downward, because removing access risks breaking something

Over time, the average person accumulates far more access than their actual job needs. That's not a hypothetical risk. That's the exact surface area an attacker uses once they get one set of credentials.

What replaced it

The shift is toward access that responds to context instead of sitting still. Rather than asking "what role is this person in," the system asks what they're doing, what they need right now, and how long they need it.

In practice that looks like:

• Attribute-based rules: Access is derived from real attributes like department, location, or employment status, and updates automatically when those change.

  
  

• Just-in-time access: Elevated permissions are granted for a defined window and expire on their own, with no cleanup ticket required.

  
  

• Continuous evaluation: Access is re-checked at request time, not just at login, so a change in status takes effect immediately.

  
  

None of this means roles disappear. It means roles stop being the whole answer. They become one input into an access decision instead of the entire decision.

Where to start

You don't have to rebuild everything to get most of the benefit. Two things move the needle fastest:

• Make access expire by default: Anything temporary should have an end date attached the moment it's granted.

  
  

• Tie access to a source of truth: If someone's status changes in your HR system, their access should change without anyone filing a ticket.

  
  

The goal isn't a more elaborate permission model. It's an access system that stays accurate without someone maintaining it by hand.