Remember when security was simple? Users had roles. Roles had permissions. Done. Those were the days when your biggest worry was whether someone from marketing accidentally got admin access to the finance system.