Role Explosion: Acknowledging the Problem

In large enterprises subject to constant employee turnover and challenging security policies, the administration of Role-based Access Control (RBAC) is a daunting task that is often highly centralized in a small team of security administrators. The aim of this work is to determine why existing models for Administrative Role-based Access Control (ARBAC) have failed to achieve success and thus motivate the requirement for a new model named One+ RBAC Administration (ARBAC1+). In order to meet this objective, the term role explosion is symptomized and supported with case studies that identify misconceptions found in previous ARBAC models. Then ARBAC1+ is proposed within the context of the Government of Canada, however, its use is not limited to this organization.