Topic starter
09/06/2026 11:28 pm
TL;DR: Human Managed describes how RBAC quickly broke down for customer-specific authorization, pushing the team toward ABAC-style policies that could express richer conditions without rewriting application code, according to Cerbos. The case shows why policy-driven authorization now matters across API access, packaging, and operational change management.
Editorial analysis by NHI Mgmt Group, based on content published by Cerbos: “Human Managed creates future-proof ABAC engine with Cerbos”.
Key questions
Q: When does RBAC become too limited for application authorization?
A: RBAC becomes too limited when access depends on resource ownership, data sensitivity, time, device, or other contextual conditions that a simple role cannot express cleanly.
Q: Why does ABAC reduce application change risk?
A: ABAC reduces application change risk because access rules can live outside the code path and be evaluated from attributes and context at decision time.
Q: What are the signs that authorization logic belongs in policy rather than code?
A: A strong sign is when engineers keep adding exceptions to the application because each customer, tenant, or package needs slightly different access rules.
Practitioner guidance
- Define where RBAC stops Map the places where role inheritance is no longer sufficient, especially customer-specific packaging, tenant exceptions, and API decisions that depend on request context.
- Move conditional logic into policy Keep if-then-else access rules out of application code when the decision depends on attributes, metadata, or runtime context that changes frequently.
- Treat policy as a governed artifact Version, test, and review authorization policy with the same discipline used for code so changes remain auditable and do not bypass change control.
Bottom line: Human Managed’s experience shows that RBAC can become too coarse when access must reflect customer-specific conditions, packaging, or request context.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
10/06/2026 1:47 am
RBAC failures are often policy-design failures, not implementation failures. Human Managed’s problem was not that roles were missing, but that roles could not express customer-specific authorization without collapsing into nested exceptions. That is the point where RBAC stops being a governance model and becomes a hidden business logic layer. The practitioner lesson is to recognise when access design is carrying product complexity that should live elsewhere.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to The 2024 Non-Human Identity Security Report.
- 23.7% of organisations share secrets through insecure methods such as email or messaging applications, which shows how quickly access governance weakens when controls are handled informally.
A question worth separating out:
Q: How do policy-driven authorization controls improve access governance?
A: Policy-driven controls improve governance by making rules explicit, testable, and versioned. That gives teams a cleaner change process, stronger auditability, and a way to update access decisions without rebuilding the application each time the business changes.
👉 Read our full editorial: Human Managed’s move from RBAC to ABAC exposes policy limits
11/06/2026 12:52 am
RBAC failures are often policy-design failures, not implementation failures. Human Managed’s problem was not that roles were missing, but that roles could not express customer-specific authorization without collapsing into nested exceptions. That is the point where RBAC stops being a governance model and becomes a hidden business logic layer. The practitioner lesson is to recognise when access design is carrying product complexity that should live elsewhere.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to The 2024 Non-Human Identity Security Report.
- 23.7% of organisations share secrets through insecure methods such as email or messaging applications, which shows how quickly access governance weakens when controls are handled informally.
A question worth separating out:
Q: How do policy-driven authorization controls improve access governance?
A: Policy-driven controls improve governance by making rules explicit, testable, and versioned. That gives teams a cleaner change process, stronger auditability, and a way to update access decisions without rebuilding the application each time the business changes.
👉 Read our full editorial: Human Managed’s move from RBAC to ABAC exposes policy limits
12/06/2026 2:27 am
RBAC failure here is a governance limitation, not just an implementation inconvenience: when access needs vary by customer, product packaging, or request context, role inheritance stops expressing the real business rule. The result is role sprawl, opaque effective permissions, and a widening gap between policy intent and runtime enforcement. For practitioners, the lesson is that authorization models must match the granularity of the decision they are trying to govern.
A question worth separating out:
Q: What are the signs that authorization logic belongs in policy rather than code?
A: A strong sign is when engineers keep adding exceptions to the application because each customer, tenant, or package needs slightly different access rules. Another sign is when troubleshooting a permission change requires source-code changes just to understand the effective decision. Those patterns show the application is carrying policy it should not own.
👉 Read our full editorial: Human Managed’s move from RBAC to ABAC exposes policy limits
This post was modified 5 days ago by NHI Mgmt Group