RBAC Role Count Calculator

Direct model = users × permissions. Role model = roles × (users per role + permissions per role). The ratio between them is the leverage RBAC buys you. Without roles, every user needs an edge to every permission, so the assignment count is the product of the two. Roles turn that product into a sum: each role is bound once to its permissions and once to each member, so the graph grows linearly rather than quadratically.

The same leverage works in reverse — once roles outnumber permissions you have rebuilt the direct model with extra objects to certify, and every access review takes longer than the one before it.

This calculator takes 5 inputs: Users in scope, Distinct permissions to grant, Roles defined, Roles held per user, Permissions bundled per role. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

It is the failure mode where teams cut a new role for every exception until the role catalogue is as large as the permission catalogue. The tell-tale signs are roles with a single member, near-duplicate roles differing by one permission, and a role count that grows with headcount instead of with job functions.

There is no universal number, but a healthy model has roughly one role per job function plus a small set of entitlement bundles, which usually lands within a small multiple of the minimum-roles figure here. If you need finer granularity, prefer attribute-based conditions on a few roles over hundreds of near-identical roles.