How to Prevent RBAC Role Explosion with Nested Access Lists
In RBAC (Role-based Access Control), a role is a defined object with explicit permissions attached to it. Because roles are designed to be fixed, changing what a particular role can do (for example, in a one-off situation where other permissions are needed for the role) requires editing the role itself. However, repeatedly editing roles makes them less flexible and re-usable, and ultimately complicates access strategies as organizations scale.