An organization's RBAC design has grown to hundreds of roles such as Sales-EU-Confidential-ReadOnly, created for every combination of region, department and data sensitivity. Administration is becoming unmanageable. Which change best addresses this problem?
Select an answer to reveal the explanation.
Short Explanation
When you need a separate role for every combination, you've hit role explosion. ABAC lets you write a few policies that read the attributes directly instead of baking every combination into a role name. Merging everything into one big role is the trap; it fixes the admin headache by throwing away least privilege.
Full Explanation
Role explosion occurs when RBAC is used to express fine-grained conditions, so each combination of factors such as region, department and sensitivity becomes its own role. The number of roles grows multiplicatively, assignments become error-prone and access reviews become impractical. Attribute-based access control addresses this by expressing the rules as policies over attributes: a single policy can state that users may read data whose region matches their own region and whose sensitivity does not exceed their clearance, replacing hundreds of combination roles. New regions or departments then require attribute values rather than new roles. Merging into one broad role simplifies administration by abandoning least privilege, granting everyone access to everything. Continuing to add combination roles deepens the very problem that made administration unmanageable. Granting permissions directly to individual users removes the abstraction entirely, multiplying the number of grants and making reviews even harder. Exam caveat: RBAC remains appropriate for coarse job functions, and many designs keep a small number of roles while moving the conditional logic into attribute policies. Operational check: map the existing roles to the attributes they encode, implement the equivalent policies in a test environment, and compare effective access for sample users before and after to confirm nothing widens.