How Authorization Quietly Breaks as Requests Pile Up
When a business system first goes live, authorization looks simple: admin, manager, and user seem like enough. But after three or four years in production, the requests keep coming: "I'm in Sales Team 2, but I need read-only access to logistics inventory." "Can you open the settlement screen for me, just this month?"
Role Explosion
Create a new role for every request and you get role explosion. Picture a 300-person company with more than 180 roles, where over 40% of those roles have exactly one user. At that point, roles are really just personal permission lists, and no one can explain who is allowed to do what.
The "Just Give Them Admin" Shortcut
Granting admin rights to unblock an urgent request is common. The problem is that those rights rarely get taken back. Excess privilege becomes a path for insider data leaks, and auditors flag it as a violation of least privilege.
RBAC vs. ABAC: When to Use Which
Roles for Functions, Attributes for Data Scope
RBAC (Role-Based Access Control) is a good fit for deciding *what a user can do*: create orders, edit prices, approve documents. ABAC (Attribute-Based Access Control) is better at deciding *which data they can touch*. It compares user attributes such as department, branch, or assigned accounts with attributes on the data itself.
A Practical Hybrid
Most real systems combine the two. A "Sales Rep" role grants the order-lookup function, and a policy like `user.branch == order.branch` limits results to the user's own branch. With ten branches, you still have one role. The trick is to keep roles to a few dozen at most and let attributes handle organizational differences.
The Exceptions You Will Always Hit
Dual Roles, Delegation, and Temporary Access
Tie Offboarding and Transfers to HR Data
Manual revocation always misses someone. Consume resignation and transfer events from the HR system to lock accounts and recalculate permissions automatically. Korea's personal information security standards also require access rights to be changed or revoked without delay when someone leaves or changes roles.
Implementation Design Points
Enforce Authorization on the Server and API Layer
Hiding a button isn't access control. Anyone who calls the API directly walks right past it. Every request should go through a shared server-side authorization module that evaluates both function permissions and data scope in one place, so policy doesn't scatter across the codebase.
Watch List Views and Excel Exports
Data rarely leaks through detail pages. It leaks through list queries and Excel exports. Teams often add scope filters to the detail API and forget the search and export queries. Apply scope conditions automatically at the query layer, and for bulk exports, require a reason and log the row count.
Auditing and Periodic Review
Keep the History and Access Logs
Log every grant, change, and revocation: who granted it, when, to whom, and why. Under Korean regulations for systems that process personal data, these records must be kept for at least three years. Access logs must be kept for at least one year, or two years if the system covers 50,000+ data subjects or handles unique identifiers or sensitive data.
Run Quarterly Access Reviews
Each quarter, send department heads a list of their team's permissions and have them mark each one "keep" or "revoke." Automatically flagging permissions unused for 90+ days cuts review time dramatically.
A Roadmap for Overhauling a Legacy Permission Model
POLYGLOTSOFT has built and overhauled ERP, MES, and WMS systems for many clients, including role consolidation, data-scope policy design, and HR-driven access revocation. If permission requests have become unmanageable or audits are getting painful, we can take you from an initial assessment through a staged migration. Our subscription development service makes it easy to start small.