Privacy by default is supposed to be simple: least privilege, zero trust, and automation baked into access policies from day one. But at scale, the theory fractures. Large-scale role explosion happens when every department, every project, every microservice spawns a new set of roles—and each one carries overlapping, often