Topic starter
09/06/2026 11:04 pm
TL;DR: Enterprise teams still spend months rebuilding roles, permissions, audit trails, and multi-service coordination in software that is not core to their business, while complex access patterns and compliance demands make simple in-house models break down, according to Cerbos. The practical issue is not whether access control is needed, but whether teams can afford to keep rediscovering the same governance and engineering debt.
Editorial analysis by NHI Mgmt Group, based on content published by Cerbos: “Embracing growth without reinventing the wheel: Insights from Cerbos CEO, Emre Baran”.
Key questions
Q: When should teams build roles and permissions in-house versus buy them?
A: Teams should build in-house only when access logic is genuinely core to the product and they can sustain the governance, testing, and audit burden over time.
Q: Why do simple role models fail in enterprise applications?
A: Simple role models fail because real organisations do not operate with only a few stable access patterns.
Q: What breaks when API permissions are managed separately for every service?
A: When permissions are managed separately for every service, identity, authorisation, and revocation evidence fragment across tools and teams.
Practitioner guidance
- Define authorization as a shared product control Treat roles and permissions as a cross-service capability with clear ownership, not a local implementation detail inside each application.
- Model for real organisational complexity Test the access model against departments, regions, exceptions, and approval chains before assuming a small role set will hold.
- Build auditability into the permission layer Require traceable decisions, change history, and revocation evidence wherever access rules affect regulated or customer-sensitive workflows.
Bottom line: Roles and permissions in B2B software become hard to manage once the application has to reflect how real organisations work.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
10/06/2026 1:16 am
Build-versus-buy is really a governance-versus-duplication decision. The central mistake in in-house authorization projects is treating roles and permissions as a narrow feature instead of shared identity infrastructure. Once multiple services, workflows, and audit requirements exist, teams duplicate policy logic across the stack and create inconsistent enforcement. The practitioner lesson is to separate application logic from policy administration early.
A few things that frame the scale:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how quickly identity governance breaks down when ownership is fragmented.
A question worth separating out:
Q: What should architects do before permissions logic is spread across multiple microservices?
A: Define a single policy model, decision owner, and audit approach before the logic fragments across services. Once permissions are embedded in many stacks and languages, consistency becomes harder to maintain and changes become expensive, which is why the governance model has to exist before the implementation sprawl starts.
👉 Read our full editorial: Build versus buy for roles and permissions in enterprise software
11/06/2026 12:21 am
Build-versus-buy is really a governance-versus-duplication decision. The central mistake in in-house authorization projects is treating roles and permissions as a narrow feature instead of shared identity infrastructure. Once multiple services, workflows, and audit requirements exist, teams duplicate policy logic across the stack and create inconsistent enforcement. The practitioner lesson is to separate application logic from policy administration early.
A few things that frame the scale:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how quickly identity governance breaks down when ownership is fragmented.
A question worth separating out:
Q: What should architects do before permissions logic is spread across multiple microservices?
A: Define a single policy model, decision owner, and audit approach before the logic fragments across services. Once permissions are embedded in many stacks and languages, consistency becomes harder to maintain and changes become expensive, which is why the governance model has to exist before the implementation sprawl starts.
👉 Read our full editorial: Build versus buy for roles and permissions in enterprise software
12/06/2026 1:53 am
Roles and permissions are now an application governance layer, not a feature. The article shows that once enterprise software has multiple user groups, services, and compliance obligations, access control stops being a narrow engineering task. It becomes part of the product’s governance model, with direct consequences for auditability, change management, and enterprise trust. Practitioners should treat authorization as a platform decision with lifecycle impact, not as a helper function bolted onto the codebase.
A question worth separating out:
Q: How should security teams evaluate whether a permission system is worth maintaining?
A: Evaluate whether the system can survive growth, compliance demands, and repeated product changes without creating hidden engineering debt. If it needs constant rewrites, duplicate rules, or manual reconciliation across services, the maintenance burden is already overtaking the original feature value.
👉 Read our full editorial: Build versus buy for roles and permissions in enterprise software
This post was modified 5 days ago by NHI Mgmt Group