1. Permission-per-user
Each new employee, customer, or team combination gets another one-off permission assignment. It works until the model becomes a patchwork of exceptions and edge cases.
Guide
Role explosion patterns that break access models
When access gets more complex, teams often respond by creating more roles. The problem is not that they are missing a role. It is that the access model has no clear inheritance or context conditions to keep it readable.
Three common patterns
2. Overly specific roles
Teams create names like 'Org Admin - Billing - EU - Finance Team - Contract View Only' so every edge case fits in a single role. It becomes impossible to explain, audit, or maintain.
3. No inheritance / no conditions
Rules are repeated in every row and every tenant without a clear parent/default. Access becomes brittle, and small context changes trigger large rewrites.
How inheritance + field-level conditions prevent explosion
A role can inherit broad defaults from its parent, then override just the exceptions that matter. Field-level conditions can narrow who sees a value, who can edit it, and which group or relationship is allowed. That keeps the model understandable without turning every edge case into a new role.