The logs scrolled for minutes. No one could tell who had access to what anymore.
This is what large-scale role explosion looks like. It spreads fast. A few new features here, a permissions tweak there, and soon developers are staring down a mass of redundant roles, overlapping permissions, and hidden access paths. The surface area for failure multiplies. Security weakens. Productivity drops as engineers waste time deciphering the mess.
Developer access is simple until it isn’t. Growth turns every permission change into a possible breach point. Legacy roles pile on top of rushed fixes until no one trusts the access model. A single misconfigured permission grants reach into sensitive data. A stale role contains old privileges no one remembers. Multiply that across hundreds of services and your environment becomes ungovernable.
The cost is real. More time in access reviews. More friction for onboarding. More risk in audits. More late-night incident calls. The team slows because every change means unraveling the past. The risk curve bends sharply upward.