The decision that does not feel like one

The arithmetic, on screen. Five environments, five hundred users, an average of two roles each — five thousand grants. Every joiner is ten actions; every leaver is ten actions, all of which must happen and none of which anyone will verify. What the group model does instead: roles assigned to groups, people added to groups, a joiner is one action, a leaver is one action, and an access review reads a membership list rather than five thousand grants. Why retrofitting is expensive — you cannot simply switch, you must map, design, assign, verify equivalence and then remove, which on a live estate is weeks plus a security sign-off. The moment to decide is before the eleventh user.