The roles multiplied overnight. What started as a handful of access patterns became thousands of narrowly scoped permissions. OAuth scopes once felt clean. Now they sprawl, intersect, and contradict each other. Security teams worry about over-privileged tokens. Engineers waste hours tracing scope mappings across services. This is the large-scale role explosion.
When OAuth is used across dozens or hundreds of microservices, scope management reaches a breaking point. Adding a new service means defining new scopes. Integrations demand exceptions. Legacy systems cling to old patterns. The result: complexity grows faster than the system itself.
Uncontrolled scope growth introduces risk. A token may gain unintended access when roles overlap. Mapping scopes to roles becomes a brittle process. Removing or altering a scope can break production integrations. Auditing who can do what turns into a manual, error-prone slog.