The system was drowning in roles. Thousands. Tens of thousands. Every microservice guarded itself behind an access proxy, each one spawning new roles, new permissions, new mappings. What began as a clean architecture was now a dense forest of policies impossible to navigate. This is large-scale role explosion. And it is breaking your platform.
Microservices promise speed and independence. Access proxies add security and policy enforcement at the edge. But at scale, they produce entropy. Every team defines its own roles. Names drift. Permissions overlap. Old roles never die. Soon, the cost of managing access is greater than the cost of building features.
Role explosion is not just clutter. It creates decision deadlocks, inconsistent authorization models, and a widening attack surface. Systems slow down under the weight of fragmented policies. Auditing becomes painful. Onboarding breaks because every user, human or machine, needs a custom path through dozens of proxies.
The root cause is duplication of access logic across services. Each proxy enforces its own rules. No central truth exists. Synchronization becomes manual, error-prone, and expensive. Attempted fixes like role consolidation often fail because proxies are bound to service-specific needs.