Role-Based (RBAC) vs Attribute-Based (ABAC) Access Control

Role-Based Access Control (RBAC) assigns granular permissions to Roles (e.g., Admin, Editor, Auditor), and users are assigned to one or more roles.

Why RBAC Works Well for Simple Apps:

• Simple conceptual model: easy for engineers and compliance auditors to reason about.
• Fast evaluation: checking if a user has a role is an O(1) set lookup.
• Sufficient for 80% of standard B2B SaaS pricing tiers (e.g., Free, Pro, Admin).

The "Role Explosion" Catastrophe:

As enterprise business requirements grow, static roles fail to capture contextual nuances:

• "Doctors can only view charts if they are currently on active shift."
• "Regional managers can only approve expenses up to $10,000 for their specific branch."
• "Engineers can only access staging clusters during business hours from corporate laptops."

To express these rules in pure RBAC, organizations create combinatorial roles: Doctor_Cardiology_ActiveShift_WestWing, Doctor_Cardiology_OffShift_OnCall, Manager_London_Limit10k... Within months, organizations end up with thousands of hyperspecific roles, making permission management an unmaintainable security nightmare.