Question

A large hospital uses RBAC to control access to its electronic health record system. Over five years, administrators have created more than 4,000 distinct roles to accommodate combinations of department, shift, location, and patient-assignment rules. Auditors now report that no one can determine which role grants which effective permissions, and provisioning new staff requires manual role selection that frequently over-grants access. Which approach BEST addresses the underlying 'role explosion' problem while preserving fine-grained control?

Accepted Answer

Migrate to an ABAC model that evaluates policies based on user, resource, and environmental attributes rather than pre-built role combinations

Answer

Convert the RBAC system to a DAC model so resource owners can directly assign permissions to individual staff

Answer

Implement MAC with sensitivity labels on all patient records and clearances on all staff accounts

Answer

Consolidate the 4,000 roles into a smaller set of broad job-title roles and accept the reduced granularity