Expiry fixes how long access lasts. It does nothing about how much of it arrives in the first place. Somebody needs to read one table, files a request, and receives a role that carries thirty other capabilities they will never touch. Nothing went wrong in that exchange. The role was the smallest unit anyone was willing to hand out, and it was already that size before the request existed.

Roles get that way for the same structural reason permissions accumulate: whoever defines a role pays for every case where it turns out too narrow, and pays nothing for every case where it’s too wide. A too-narrow role generates a ticket, an interruption, a person blocked in the middle of something. A too-wide role generates a line in an audit report that nobody reads. So each time a member of the role hits a wall, the role grows by exactly enough to clear that wall — and never shrinks, because the member who needed it is still there. Run that for two years and the role is the union of everything every member has ever needed, held simultaneously by all of them.

The result is a set of permissions that fits nobody. It is too wide for every individual and exactly right only for a hypothetical person who does all the jobs at once. That hypothetical person is the one your access model actually describes, and they don’t exist. What does exist is a room full of people each carrying a superset of their work, where the superset’s contents are determined by their least similar colleague.

The reflex fix is more roles — split the big one, define finer grains, get closer to the real shape of the work. It helps briefly and then decays, because the same asymmetry operates on the new roles too, just at a smaller scale. Fine-grained roles proliferate until nobody can reason about which one to request, at which point people request the broad one again because it’s the one they can name. Granularity without a countervailing force is just a slower version of the same drift.

The force that’s missing is a cost for width at the moment of granting. Not a review board — those are the same quarterly-diligence trap that revocation falls into. Something closer to friction proportional to scope: a wide grant needs a reason attached, a narrow one doesn’t; a wide grant is short-lived by default while a narrow one can last; the request form shows what fraction of the role’s capabilities the requester’s team has actually used in the past month. None of that forbids the wide grant. It just makes the wide grant something a person chose, rather than the path of least resistance.

Because that’s the honest description of the current state. Nobody decided that the new hire should be able to modify billing configuration on their second day. Somebody decided the role should include it, once, for a colleague, three years ago — and the shape of that decision was inherited by everyone who came after, silently, as the default meaning of belonging to a team.