Roles get messy fast. At what point did you realise RBAC wasn't enough?

it starts clean. admin, editor, viewer. three roles, clear boundaries, everyone knows what they can do.

then the product grows. a customer needs access to one thing but not another. a team member needs editor rights in one context and read-only in another. someone asks for a role that's basically admin but without the billing tab. and suddenly you have eleven roles, three of them named some variation of 'editor-but-not-really,' and nobody is confident the permissions are actually right anymore.

this is where most teams realise that roles alone aren't the answer. the problem is that roles try to encode both who someone is and what they can do in one flat label. once those two things need to vary independently, the model breaks.

the cleaner approach is to separate membership from permissions. organise users into groups based on who they are, finance team, beta users, enterprise customers. then write policies that use group membership as context when deciding what's allowed. the groups stay stable. the policies handle the nuance.

curious where people hit the wall with RBAC. was it a specific customer request, a compliance requirement, or just a point where the role list got too long to reason about?