Role based security is a very common model for software nowadays. It is very powerful but requires careful configuration to leverage the benefits of shared roles. It is easy for a mess to be made for example when the admin user simply creates a role every time a change is needed (instead of leveraging existing roles).
Very broad question here but as the designer of the role based security software application, how can I assist the user in avoiding this problem? How can I detect duplication or detect ways the security role setup can be normalized?
Edit: I would like to emphasize that customizable security roles is a vital feature in the product. Also, the problem at hand here is to normalize existing configurations that have gotten out of control for existing customers. Discussion on design of the software itself is not what I am after.