The cluster of roles kept growing, faster than the team could track. What started as a clean permissions model had turned into an unmanageable tangle of policies and duplicates. This is large-scale role explosion, and it’s where most Open Policy Agent (OPA) deployments hit a wall.
OPA is powerful for enforcing fine-grained, context-aware decisions across distributed systems. At scale, though, role explosion becomes a critical bottleneck. The more services and teams you onboard, the more roles get minted—often by different owners, with overlapping rules, inconsistent names, and fragmented scopes. Each new role increases the surface area for errors and slows audits, troubleshooting, and feature delivery.
The cause is structural: OPA policies often map to role-based access control (RBAC) structures that grow linearly with the number of resources and actions. Without careful design, this turns exponential once you account for environment-specific overrides, microservice-level customizations, and cross-team exceptions. The result is hundreds or thousands of roles, many obsolete but still active, creating security risk and operational drag.