Under HIPAA, every access to Protected Health Information (PHI) must be necessary, minimal, and logged. Large systems often start clean, with a handful of well-defined roles. Then features ship. Teams grow. Exceptions pile up. Before long, hundreds of overlapping roles exist, impossible to audit without manually mapping each permission. This