Slack org-scoped admin
An admin may manage one org or a subset of workspaces, even when the same role is assigned to multiple users. The decision depends on org membership and context, not just the role name.
Guide
Role × Action Is Not Enough: When Relationships Matter
In many access models, the question is not only “what is this user's role?” It is also “what org, team, project, or record relationship are they in?” Once relationships matter, a simple role × action table becomes incomplete.
Examples
Jira project lead
A project lead may approve changes for one project but not another. The relationship to the project matters more than the generic role label.
Vendor store_id
A vendor can manage records only when store_id matches their assigned storefront. The resource context is the rule, not the role alone.
Why the anti-pattern breaks
When teams create a new role for every exception, the model grows faster than the team can explain it. A vendor role with a condition is easier to understand than a custom role for every customer or arrangement.