Role-Based Access Control (RBAC) is often treated as a one-time project: define the roles, map the permissions, done. In practice, roles drift the moment the org chart changes — and most enterprises don't notice until an audit does.
How Roles Quietly Go Stale:
- New systems and applications get added without updating existing role definitions.
- Employees pick up extra permissions through one-off requests that never get folded back into their role.
- Departments reorganize, but the roles built around the old structure stay untouched.
Why This Becomes a Governance Problem:
- Stale roles lead to over-provisioning, since it's easier to grant broad access than to redesign a role.
- Auditors increasingly ask not just "does RBAC exist" but "is it still accurate."
Bottom Line:
RBAC delivers value only when role definitions evolve alongside the organization. Treating role design as a living, periodically reviewed process — not a one-time exercise — is what keeps RBAC meaningful rather than decorative.
