--- title: How to Prevent RBAC Role Explosion with Nested Access Lists description: Role explosion occurs in RBAC systems when the number of roles grows faster than the number of users, as administrators create near-duplicate roles or broaden... canonical: https://daily.dev/posts/how-to-prevent-rbac-role-explosion-with-nested-access-lists-oc0a0hewj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How to Prevent RBAC Role Explosion with Nested Access Lists | daily.dev og:description: Role explosion occurs in RBAC systems when the number of roles grows faster than the number of users, as administrators create near-duplicate roles or broaden... og:url: https://daily.dev/posts/how-to-prevent-rbac-role-explosion-with-nested-access-lists-oc0a0hewj og:image: https://api.daily.dev/og/posts/Oc0A0HeWj.png og:image:alt: How to Prevent RBAC Role Explosion with Nested Access Lists og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How to Prevent RBAC Role Explosion with Nested Access Lists **[Teleport](https://daily.dev/sources/teleport)** · 7 min read · 0 upvotes · 0 comments ## Summary Role explosion occurs in RBAC systems when the number of roles grows faster than the number of users, as administrators create near-duplicate roles or broaden permissions to handle team-specific exceptions. Nested access lists offer an alternative: instead of editing roles, admins map users to access lists that can themselves be nested inside other lists, inheriting member or owner rights across multiple layers. This lets a small, fixed set of roles remain reusable while access lists (which can be created manually or generated automatically by identity providers like Okta) absorb the changing membership needs, enabling scalable, hierarchical access control across large organizations such as ones running hundreds of Kubernetes clusters. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is role explosion in RBAC and why does it happen? Role explosion is when an organization's number of RBAC roles grows faster than its number of users, making privilege management harder and slowing login checks. It happens because different teams need different permission mixes, and administrators under pressure often create near-duplicate roles or broaden access rather than edit a shared role that others depend on, since editing a shared role risks changing access for everyone who holds it. _Explore more access-control patterns like this by following RBAC and identity governance topics on daily.dev._ ### How do nested access lists work in Teleport? In Teleport, an access list can contain other access lists nested as members or owners, and users in a nested list inherit access from the parent list as long as they meet both lists' membership requirements. Membership nesting inherits the parent's roles and traits, while owner nesting inherits management rights over the parent list, and this can cascade through multiple layers, e.g. an 'all employees' list nested under a wiki-access list. _Track identity and access-control tooling changes like Teleport's on daily.dev before they hit your infrastructure._ ### How can access lists prevent the need to create new RBAC roles for cross-team access requests? Access lists map users to roles, so granting cross-team access means adding a user to a list rather than editing or duplicating a role. For example, adding an engineer to another team's API access list grants access without a manual role edit, and nesting that list under a broader group like a company-wide backend engineering list means new members automatically inherit access to every nested team's services. _Compare access-control strategies for scaling teams and infrastructure by following backend security discussions on daily.dev._ ## Similar posts on daily.dev - [Why Kubernetes RBAC Misconfigurations Are the Easiest Privilege Escalation You’ll Ever Find](https://daily.dev/posts/why-kubernetes-rbac-misconfigurations-are-the-easiest-privilege-escalation-you-ll-ever-find-7zx0y67wq) · Cloud Native Now · 1 upvotes · 0 comments - [Kubernetes Security Mistake: Cluster Admin Everywhere](https://daily.dev/posts/kubernetes-security-mistake-cluster-admin-everywhere-seewrtwvu) · Medium · 2 upvotes · 0 comments - [RBAC vs ReBAC: Comparing Role-Based & Relationship-Based Access Control](https://daily.dev/posts/rbac-vs-rebac-comparing-role-based-relationship-based-access-control-a4hkfzjx5) · Security Boulevard · 0 upvotes · 0 comments - [What Is Role-Based Access Control \(RBAC\)?](https://daily.dev/posts/what-is-role-based-access-control-rbac--ofppjlkdu) · Nordic APIs · 0 upvotes · 0 comments - [Applying RBAC to databases on Kubernetes: Practical, real-world examples](https://daily.dev/posts/applying-rbac-to-databases-on-kubernetes-practical-real-world-examples-pwwhwtwkk) · CNCF · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/how-to-prevent-rbac-role-explosion-with-nested-access-lists-oc0a0hewj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How to Prevent RBAC Role Explosion with Nested Access Lists","url":"https://daily.dev/posts/how-to-prevent-rbac-role-explosion-with-nested-access-lists-oc0a0hewj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-to-prevent-rbac-role-explosion-with-nested-access-lists-oc0a0hewj"},"datePublished":"2026-08-23T12:23:03.193Z","dateModified":"2026-08-23T12:51:13.762Z","description":"Role explosion occurs in RBAC systems when the number of roles grows faster than the number of users, as administrators create near-duplicate roles or broaden...","image":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","thumbnailUrl":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-to-prevent-rbac-role-explosion-with-nested-access-lists-oc0a0hewj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"How to Prevent RBAC Role Explosion with Nested Access Lists"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-to-prevent-rbac-role-explosion-with-nested-access-lists-oc0a0hewj#faq","mainEntity":[{"@type":"Question","name":"What is role explosion in RBAC and why does it happen?","acceptedAnswer":{"@type":"Answer","text":"Role explosion is when an organization's number of RBAC roles grows faster than its number of users, making privilege management harder and slowing login checks. It happens because different teams need different permission mixes, and administrators under pressure often create near-duplicate roles or broaden access rather than edit a shared role that others depend on, since editing a shared role risks changing access for everyone who holds it. Explore more access-control patterns like this by following RBAC and identity governance topics on daily.dev."}},{"@type":"Question","name":"How do nested access lists work in Teleport?","acceptedAnswer":{"@type":"Answer","text":"In Teleport, an access list can contain other access lists nested as members or owners, and users in a nested list inherit access from the parent list as long as they meet both lists' membership requirements. Membership nesting inherits the parent's roles and traits, while owner nesting inherits management rights over the parent list, and this can cascade through multiple layers, e.g. an 'all employees' list nested under a wiki-access list. Track identity and access-control tooling changes like Teleport's on daily.dev before they hit your infrastructure."}},{"@type":"Question","name":"How can access lists prevent the need to create new RBAC roles for cross-team access requests?","acceptedAnswer":{"@type":"Answer","text":"Access lists map users to roles, so granting cross-team access means adding a user to a list rather than editing or duplicating a role. For example, adding an engineer to another team's API access list grants access without a manual role edit, and nesting that list under a broader group like a company-wide backend engineering list means new members automatically inherit access to every nested team's services. Compare access-control strategies for scaling teams and infrastructure by following backend security discussions on daily.dev."}}]} ```