Role-based access sure tends to drift over time. Exceptions pile up and suddenly roles have hundreds of permissions.

I find looking at anomalies instead of giant entitlement lists makes a lot more sense.